What is an AI agent? A plain-English answer.
An AI agent is software that uses a language model to work toward a goal. It reads instructions, gathers context from approved sources, chooses tools, and prepares or takes actions within limits you set. A chatbot only replies. An agent completes steps in a workflow, and a good one stops for a person when it is unsure.
The definition, one piece at a time
Strip the marketing away and an agent has six parts. Each one is a decision you make, not a feature you buy.
- A goal and instructions
- What the agent is for, what counts as done, and what it must never do. Written down, versioned, and owned by someone.
- A model
- The language model that reads, reasons, and drafts. It predicts likely text. It does not know your business unless you supply the facts.
- Context
- The approved sources the agent may read: policies, records, tickets, documents. Retrieval brings the relevant passages to the model for each task.
- Tools
- Defined actions the agent may request: look up an order, draft an email, create a record. Each tool has a permission: read, propose, or write.
- Memory
- What the agent keeps between steps or sessions. Decide what is remembered, for how long, and who can see it.
- A review point
- Where a person checks the work before it takes effect. Preparing a reply is not sending it. Flagging a duplicate is not paying an invoice.
Anthropic draws a useful line: in a workflow, code decides the order of steps and the model fills them in; in an agent, the model directs its own process and tool use. Most business systems that work well are workflows with agent-like steps inside them, not free-roaming agents. OpenAI’s guide says the same in different words: agents run a workflow on your behalf, with guardrails, and hand back to a person at defined points.
Agent, chatbot, automation, or retrieval? One table
The words get mixed up in sales conversations. The table separates them by what decides, what they are good for, and what to watch.
| Approach | What decides | Best for | Risk to watch |
|---|---|---|---|
| Rules-based automation | Rules you wrote | Predictable steps with clean inputs: routing, reminders, status updates | Breaks silently on inputs the rules never anticipated |
| Chatbot or assistant | The model, per reply | Answering questions, drafting text for one person at a time | Confident answers without sources; no action beyond the reply |
| Knowledge assistant (retrieval) | The model, from approved sources | Finding the current policy, procedure, or record with a citation | Stale or restricted sources; access rules that are not tested |
| Tool-using agent | The model, within a permission matrix | Multi-step work: gather context, check, prepare a record, route to a reviewer | Over-reach, prompt injection, cost per task, drift over time |
The right choice usually follows two questions: how much judgment does the task need, and how reversible are its actions? Low judgment and reversible actions favor rules. High judgment with irreversible actions favors an agent that prepares and a person who decides. The compare page walks through the decision with examples.
What an agent looks like inside a business
Three shapes come up again and again. None of them sends, files, or pays without a person.
- Triage and preparation. A support ticket arrives. The agent classifies it, pulls the account and the current policy, drafts a reply with the source attached, and puts it in front of the agent who owns the queue. Support ticket triage shows the inputs and the boundary.
- Checks with evidence. An invoice arrives. The agent extracts the fields, compares them with the purchase order and prior invoices, flags a likely duplicate, and leaves the matching references for finance. The worked example runs one such check on synthetic data.
- Answers with citations. A colleague asks for the current procedure. The agent searches approved collections, returns the passage and the template, and escalates when the answer only exists in a restricted note. Knowledge search describes the permission tests that matter.
In each case the valuable part is not the model. It is the written goal, the approved sources, the permission matrix, the test cases, and the review point. Those are what we build and hand over.
Where agents go wrong
Agents fail in patterns. Naming them early makes the tests obvious.
- Wrong or stale source. The agent answers from an old policy or a file that belongs to another client. Fix: version the sources, test removal and access changes, cite the passage.
- Over-reach. The agent takes an action nobody agreed to because a tool allowed it. OWASP lists this as excessive agency in its Top 10 for LLM applications. Fix: least privilege per tool, approval gates for writes.
- Prompt injection. An email, web page, or document contains instructions that try to redirect the agent. OWASP ranks it first. Fix: treat all retrieved content as data, confirm before actions, test with injected inputs.
- Confident gaps. The agent fills a missing field with a plausible value. Fix: stop rules that say what is missing and who to ask.
- Drift. A model or source changes and results shift while the workflow stays the same. Fix: a fixed test set rerun after every change. AI quality monitoring describes the routine.
- Cost creep. Multi-step work uses far more tokens than a single reply. Gartner puts agentic models at five to thirty times the tokens per task of a standard chatbot. Fix: measure cost per accepted task, not token price.
Microsoft’s taxonomy of failure modes in AI agents groups these into safety and security failures, novel and existing, and is a useful checklist when you design tests.
Six questions before you build one
- Which single task, and who owns it? One trigger, one finish, one person who can say whether the result is acceptable.
- Which sources, and who keeps them current? Name the collections, their versions, and the access rules.
- What may it read, propose, and do? Write the permission matrix per system before choosing a model.
- When must it stop? Missing data, conflicting records, restricted content, anything irreversible.
- How will you test it? Twenty to thirty real cases including the awkward ones, with expected results.
- What does an accepted result cost? Model, tools, retries, and review time, divided by accepted results.
The pilot checklist turns these into twelve decisions in order, with a one-page brief you can download.
What we build, and what we do not
We build agents around a defined job with clear limits: the sources, the tools, the permission matrix, the stop rules, the test set, and the review point. We hand over the operating record so your team can run it. We do not build agents that send, file, or pay without a person, and we do not promise an agent can replace the people who know the work. The AI agents service describes what an engagement includes.
Sources
External references used in this guide. Figures are quoted with their original baseline; none is a measurement of our own work.