Most teams building enterprise AI agents run into the same problem. The prototype goes well, understands messy questions, follows tangents, and sounds like a person instead of a phone menu. But then someone from risk or compliance asks whether it will always read the required disclosure word for word — and the answer is no, because a language model can’t make that promise on its own.
Enterprise teams have traditionally had two ways to respond:
- Let the model run the conversation, which makes the agents quick to build and natural for customers to talk to but hard to predict.
- Script every step, which makes the agents easy to audit and reliable but slow to build and stiff to use.
Some teams pick one approach per project and live with the downside. Others run both side by side, leaving them with two stacks to build, test, and maintain.
Progressive control offers another option. It treats control as something you set for each part of an agent, so the parts that can be flexible stay flexible, and the parts that need guardrails get them. Below, we walk through how it works, when it helps, and how to decide where control belongs in your agents.
One agent, many kinds of risk
Think of a support agent at a retail bank. Over the course of a day, it might explain overdraft fees, help someone locate the closest ATM, replace a lost debit card, open a dispute on a transaction, and walk a customer through a wire transfer.
Those jobs carry very different stakes. If the agent explains a fee in slightly different words each time, tailored to the customer’s question, nobody is harmed; in fact, that variety is part of what makes the exchange feel personalized. Meanwhile, a card replacement session needs specific answers before anything can happen, including which card was involved, why it’s being replaced, and where the new card should be sent. And a wire transfer leaves no room for interpretation at all. The steps need to happen in the right order, and the terms and conditions a customer agrees to must be stated exactly.
When an agent is built as a single block, it gets a single level of control. Loosen it, and high-stakes steps become a risk. Tighten it, and everyday questions become slow to build and robotic to answer.
How progressive control works
Progressive control starts by treating an agent as a set of skills. A skill is one specific, discrete job the agent knows how to do, like answering product questions, replacing a card, or processing a payment. An orchestrator sits above those skills, working out what the customer needs and handing the conversation to the right skill.
.png)
Every skill begins as plain-language instructions, written the way you’d brief a capable new hire. Many skills never need more than that. When a skill needs firmer handling, you can add guardrails. In Rasa, these guardrails are called rules: specific behaviors the framework enforces, so the model can’t skip them or improvise around them. You can add guardrails one at a time, only where the business needs them, and without having to rewrite the skill to do it.
Engineers call fully scripted behavior deterministic, meaning the same situation or prompt produces the same steps every time. With progressive control, each skill can sit anywhere between fully deterministic and fully flexible. That’s the dial: every skill has its own setting, and all of them run inside the same agent.
What a guardrail looks like
Guardrails are small and specific. In Rasa, each one is a rule, and most rules fall into four types:
- Required value: The agent can’t move forward until it has a particular piece of information, such as an account number or the reason behind a request.
- Confirmation step: Before it takes an action, the agent plays back what’s about to happen and waits for a clear authorization.
- Exact wording: Certain language, like a legal disclosure or the terms and conditions behind an offer, is delivered word for word every time.
- Strict sequence: Steps must happen in a set order, like verifying a customer’s identity before any of their account details are shown.
Consider the card replacement example. It might start as a few lines of instructions: check that the customer is eligible, ask which card is involved and why, sort out shipping logistics, and process the replacement. Once it’s handling real customers, the team might make the reason for replacement a required value and add a confirmation step before the new card is ordered, with the rest of the conversation staying as natural as it was before. Each guardrail is a small, deliberate decision, and none requires starting from scratch.
Across the whole support agent, the dial might be set like this:
Where control belongs
The most useful question to ask about any skill is what it involves and what would happen if it went wrong. A few answers tend to call for stepped-up guardrails:
- Money, personal data, or account access changes hands
- A regulator, contract, or legal team cares about the exact wording
- The order of the steps matters, as with verifying identity before sharing account details
- The skill runs at high volume, so a small error rate adds up to a large number of affected customers or accounts
Every regulated industry has its own version of this split, where most of the conversation can stay flexible but a few specific steps cannot.
For instance, an insurer’s AI agent can talk freely about what a policy covers and still read claims disclosures exactly as written. A telecom agent can troubleshoot a slow connection conversationally, then follow a fixed, approved sequence before it changes someone’s plan. A healthcare provider’s agent can let patients describe what they need in their own words and point them to the right clinic, while always verifying their identity before discussing anything personal. And a public-sector agent can help residents figure out which service they need, then run the same eligibility check for everyone before confirming a benefit.
In each case, the level of control follows the level of risk. The agent stays conversational wherever it can and adds guardrails only at the steps where a mistake would be costly.
Why start with flexibility
Locking every skill down from day one can feel like the safer choice. But starting at the flexible end tends to serve teams better, for a few practical reasons:
- You get to a working agent sooner: Plain-language instructions are quick to write and easy to change, so teams can put real conversations in front of the agent early and learn from them.
- Real conversations show you where control is needed: Guesses about which steps will cause trouble are often wrong. When you start from flexibility and watch what happens, guardrails go where they’ve proven necessary instead of everywhere “just in case.”
- The flexible parts keep their natural feel: Customers get the responsiveness of a modern AI agent for most of the conversation, with the precision of a scripted flow arriving in the moments that call for it.
- More people can follow what the agent does: Because skills start in plain language, product managers, compliance teams, CX leads, and other non-technical roles can read a skill and understand it right away. That makes reviews smoother, so it’s easier to align on where guardrails belong. (To see how different kinds of builders can work on the same agent, check out our One Agent, Three Ways to Build live demo.)
What changes for your team
When control becomes a per-skill decision, several familiar tradeoffs ease. Here’s what that looks like in practice:
- Speed and scrutiny in one agent: You can move quickly on low-risk journeys and keep high-scrutiny ones tightly governed on one stack, with no second system to build, test, and maintain.
- A cleaner approval process: Compliance and risk teams get specific guardrails they can review and sign off on, in place of a general assurance that the AI will behave.
- Skills that carry forward: A card-replacement skill your team has already proven can go into the next agent with its guardrails attached, so each new project builds on proven, reusable skills from day one.
The biggest payoff comes with scale. Over time, that reuse turns individual agents into an agent factory: a shared library of skills, guardrails, and practices that every team in the organization can build on. Each agent you ship makes the next one faster to build and easier to trust.
How Rasa approaches control
Rasa has spent years helping regulated enterprises build agents for conversations where mistakes are costly. That work has historically started from control and scripted flows, with flexibility added where it’s safe.
Progressive control reverses that starting point, so teams begin with flexible skills and add control when and where it’s needed.
Progressive control is a core idea behind Mantle, the orchestrator at the center of Rasa’s platform. In Mantle, a skill can start as a single file of plain-English instructions, with teams layering in rules the framework enforces only where the use case calls for it. The dial can swing anywhere from fully flexible to fully deterministic, all within a single agent.
If you’re working out how much control your agents need, we’d be happy to help you map it out. Talk to our team to learn more →
Frequently asked questions about progressive control
What is progressive control?
Progressive control is an approach to building AI agents where each skill starts as plain-language instructions and gains enforced guardrails only where the business needs them. It lets every part of an agent sit at its own point between fully flexible and fully deterministic.
How does progressive control relate to guardrails?
Progressive control is how you decide where guardrails go. Across the industry, “guardrails” usually means checks around a language model, such as filters that screen what users send in and what the model sends back. Rasa adds a second kind inside each skill, which it calls rules: a required value, a confirmation step, exact wording, or a strict sequence, enforced by the framework whether or not the model would have followed them. The two kinds work well together, and progressive control lets teams add rules one at a time, only to the skills and steps that need them.
What’s the difference between an agentic skill and a deterministic one?
The difference between an agentic skill and a deterministic one comes down to who decides what happens next: the language model or the framework. In an agentic skill, the language model decides how to handle the conversation, which makes it flexible and natural to talk to. In a deterministic skill, the framework enforces what happens and in what order, so the steps are the same every time, and any wording you’ve locked in is delivered word for word. With progressive control, a skill can be agentic, deterministic, or a mix of both.
Will adding control make my agent sound robotic?
Adding control won’t necessarily make your agent sound robotic, because only the steps you govern change. Guardrails apply to specific moments, such as a confirmation or a required disclosure, while the rest of the conversation stays as natural as before.
Do we need separate systems for flexible and scripted behavior?
No, you don’t need separate systems for flexible and scripted behavior. With progressive control, flexible and governed skills run in the same agent on the same stack. That means teams don’t have to build, test, and maintain two different systems side by side.
Who decides where control goes?
Usually, the team that owns the agent decides where control goes, with input from the people who own the risk, such as compliance, legal, or operations teams. Because skills start in plain language, those stakeholders can easily read what a given skill does and point to the steps that need guardrails.
Can we add control after an agent is live?
Yes, you can add control after an agent is live, and that’s one of the main reasons to start from a flexible place. Teams can watch how real conversations go and add guardrails one at a time where they’re needed, without having to rewrite the entire skill.
Is progressive control only for regulated industries?
No, progressive control is not only for regulated industries. Any agent with high-stakes steps can benefit from it, whether those steps involve money, personal data, or commitments a business must honor. It matters most in industries like banking, insurance, healthcare, and telecom, where specific wording and sequencing are often required.
How does Rasa support progressive control?
Progressive control is built directly into Mantle, the orchestrator at the center of Rasa’s platform. Skills start as plain-English instructions, and teams can add framework-enforced rules wherever and whenever they’re needed.
Are Rasa agents fully deterministic?
Rasa agents are as deterministic as you want or need them to be. With Mantle, every skill starts flexible, with the language model handling the conversation, and teams add deterministic behavior only to the steps that require it. A single agent can include fully flexible skills, fully deterministic skills, and everything in between. Where a deterministic rule applies, the framework enforces it on its own, so the model can’t talk its way around it.
How does Mantle relate to CALM?
CALM (Conversational AI with Language Models) and Mantle are two ways of building agents on the Rasa platform, and each starts from a different place. CALM starts from structure: language models interpret what the user wants, and predefined flows set the steps the agent takes, with flexibility added where it’s safe. Mantle, which Rasa introduced in 2026, starts from flexibility: skills begin as plain-language instructions, and teams add deterministic behavior only where the business needs it.
Why does determinism still matter for AI agents?
Determinism still matters for AI agents because some steps have to happen the same way every time. For example, when an agent moves money, verifies someone’s identity, or delivers a required disclosure, even a slightly different answer can create real problems for the business and its customers. Rasa’s view is that determinism belongs where the stakes call for it, so the rest of the agent can stay flexible and conversational.
