Last weekend the season finale of House of the Dragon ran for seventy-five minutes. I decided that was long enough to build an agentic chatbot. That was my goal. And I was determined to make it. So I watched the episode on one screen with a terminal open on the other, betting myself I could have it working before the credits.
The bet held, roughly. By the time the credits ran I had a working chat interface, a dashboard, tool access, and a model that could take a request, work out what needed doing and go do it. Under any definition anyone would recognise, it was agentic. It was also completely ungoverned. No limits on what it could touch, no record of what it had done, no point at which a human had to agree before something happened.
It was a dragon nobody had trained yet. Capable of everything, governed by nothing.
It took me longer than it should have to notice what I was actually doing. I was raising dragons.
Mine did not breathe fire. They called APIs, queried databases, picked tools, passed information between themselves, and every so often did something I had not thought to forbid. That last part is the entire job.
the week that followed
Seven days later I am still working on it, and none of that week went into capability. Capability was finished before the episode was.
The week went into the part nobody films. Logging, so that every action the system takes leaves a record that outlives the session. Attribution, so that a month from now it is possible to say which change came from a person and which came from the model, because a log that cannot answer that question is a count, not an audit trail. Explicit intervention points, where the thing stops and waits for a human rather than proceeding because proceeding was technically possible. Boundaries on what it may reach: which systems, which tables, which operations, and what happens to a request that falls outside them.
I built those against the EU AI Act as a reference rather than an obligation. Most of what I run is nowhere near the high-risk tier, and the Act attaches its heavy requirements, the documentation, the retention periods, the designed-in human oversight, to systems that land in specific categories. Mine does not. But the Act is the most carefully argued description available of what a system needs in order to be answerable for itself, and using it as a design brief costs nothing when you are building anyway. Retrofitting it later costs a great deal.
Seventy-five minutes to build. A week to make it safe to run, and it is not finished.
the ratio is the whole point
That ratio is not a story about me being slow. It is the shape of the work now, and almost every conversation about AI adoption has it backwards.
Getting an AI agent to do something impressive is a weekend. Getting it to do the impressive thing you actually asked for, and nothing else, is the work — and it is the part nobody puts in the demo. The demo is always the seventy-five minutes. The week never appears, because a week of writing rules and watching them fail does not screenshot well.
Which is the oldest problem there is with anything powerful. Nobody who has ever trained an animal struggled with what it was capable of. Capability is what the animal came with. The training is everything else, and it does not end.
The capability arrives intact, in a weekend, for anyone. What separates a system you can put in front of a customer from a system you can only put in front of a colleague is the thing that takes the week, and then keeps taking time, because every rule I wrote turned out to be either loose enough that the model did something I had not anticipated, or strict enough that it refused work a person would have approved. Each round teaches you the distance between the constraint you described and the constraint the model inferred, and that distance is always wider than it looks from where you are standing.
what this costs, and where it gets budgeted
Here is the practical consequence, and it is the reason this is worth more than an anecdote.
When a team asks for budget to build with agents, the number they produce is almost always the seventy-five minutes. The platform, the seats, the licence, the sprint. That number is real and it is also the smallest part of the total, and because the taming is invisible in every demo the team ever watched, nobody thinks to price it.
Worse, it gets priced as a one-off when it behaves like a subscription. My guardrails are not finished, and they will not be finished when the system goes live either. A model version changes and the constraint that used to hold stops holding. A user tries something nobody imagined and finds a gap. The rules are a relationship you maintain, not a state you reach, which means the taming is operating expenditure wearing the costume of a project.
So the honest budget line for anything agentic has two entries, and the second one recurs. If your plan only has the first, you have not planned to run a system. You have planned to hatch one.
before you send it to battle
My agentic dragons are still in training. They are close, and close is not the same as ready. Close is where the fire lands somewhere you did not choose.
AI is a wild and powerful creature by nature, dangerous by default, and useful only to whoever learns to tame it. So if you are shipping anything this year, learn to tame what your dragons can do before you send them to battle. Which in our world is called production.