What Is an AI Agent?
What distinguishes an agent from a chatbot, and where each belongs.
What is an AI agent?
An AI agent is a system where a language model plans and carries out a multi-step task using tools — searching data, calling APIs, writing records — rather than only answering a question. Agents suit tasks whose steps vary by case. They require explicit limits on what they may access and change.
The term is used loosely, often for anything involving a language model. The useful distinction is whether the system takes actions across multiple steps or simply produces text.
How is an agent different from a chatbot?
A chatbot answers questions, usually one exchange at a time. An agent plans a sequence, uses tools to gather information or make changes, and works towards completing a task. The difference matters because an agent's mistakes become actions rather than just incorrect sentences.
Many products marketed as agents are chatbots with a few integrations. Ask what actions the system can take autonomously — that is the real distinction.
When is an agent the right choice?
When the steps genuinely vary by case and the required tools are well defined — research across several systems, triage that needs lookups before deciding, gathering information from multiple sources. When steps are identical every time, ordinary automation is cheaper and more reliable.
Building an agent for a fixed sequence adds unpredictability and cost to something a script would do better.
What are the risks?
An agent with broad permissions can take wrong actions at speed. It can be manipulated through content it reads, since instructions embedded in data can influence behaviour. And its cost per task is variable because it makes multiple model calls.
Practical controls: narrow tools, least-privilege permissions, approval gates on irreversible actions, iteration and cost limits, and complete logging of every step.
Should agents have write access to production systems?
Only narrowly, and with approval gates on anything irreversible — payments, deletions, external communications. Read access is generally lower risk. Broad write access to production systems is not advisable however capable the underlying model is.
Separating read and write tools explicitly, rather than granting a single integration full access, is a straightforward way to limit exposure.
How reliable are agents?
Less reliable than deterministic code, and improving. They are best treated as capable assistants that need supervision on consequential work, not as unattended staff. Evaluation against realistic and awkward test cases before release is essential.
Expect to build a test suite of real cases. Without one, changes to prompts or models silently alter behaviour in ways nobody notices until something goes wrong.
Services related to this topic
Related solutions
More on ai
Want help applying this?
Tell us your situation and we will tell you what we would actually do first.