What Is an AI Agent—Really?

Agents become much easier when you stop asking whether software is an agent and start asking where decisions are made, what actions are possible, and how control is preserved.

Mission

By the end of this chapter, you can define an AI agent precisely, identify its boundary in a system, and explain why “agent” is a design property—not a synonym for intelligence.

Prerequisites: none. Build artifact: an agent boundary card for a real or imagined product. Time: 45-60 minutes.

Before you read: Predict → Commit → Connect

Consider a travel chat app. It can answer policy questions, look up a booking, calculate a fare difference, and request a booking change.

1. Is it an agent if a programmer predefines the exact order of all four steps?
2. Is it an agent if a language model decides which step is needed next?
3. Does giving it more tools automatically make it more intelligent?

Write one sentence defining agent. Keep it; you will revise it at the end.

The smallest useful definition

An AI agent is a system that uses a model to choose actions toward a goal, observes what happens, and can adapt the next choice—inside human-designed boundaries.

Every phrase matters:

• System: the model alone is not the agent. The surrounding software supplies instructions, context, tools, state, security, and stopping logic.
• Uses a model to choose: at least one meaningful next step is selected at runtime rather than completely fixed in code.
• Actions toward a goal: an action may retrieve data, call a service, ask a person, create a proposal, or return an answer.
• Observes and adapts: a tool result can change the next decision.
• Boundaries: people still choose permissions, budgets, policies, approval gates, and when the run must stop.

This is an operational definition, not a philosophical claim. It tells a builder what to inspect.

The model is a component, not the product

A bare model maps input to output. It has no inherent access to your calendar, database, browser, or payment system. Software may offer those capabilities as tools. Software also decides which context the model sees, validates arguments, executes allowed calls, records state, and ends the loop.

Saying “the model booked the trip” hides the important engineering. A more useful sentence is: “The application let the model propose a hold_itinerary call; policy code validated the customer, capped the price, required approval, executed the hold, and recorded the result.”

That sentence makes ownership and risk visible.

Agents existed before language models

In classical artificial intelligence, an agent is broadly something that perceives an environment and acts in it. A thermostat senses temperature and switches heating; a chess program observes a board and chooses a move; a robot reads sensors and controls motors. Some use fixed rules, some planning, some learned policies.

Modern LLM agents are a narrower engineering pattern. A language model interprets flexible goals and context, then proposes responses or tool calls. They are unusually useful where inputs are messy—language, documents, semi-structured screens—and where the exact path is difficult to enumerate.

Do not rewrite history by claiming agents began with language models. Also do not call every controller an “LLM agent.” Name the kind of decision maker you actually use.

“Agent” is a gradient, not a magic badge

Systems vary along several dimensions:

• Choice: fixed sequence → chooses among steps → creates a plan.
• Action: writes text → reads systems → changes systems.
• Time: one turn → multi-step run → long-running job.
• Scope: one narrow task → several tasks → open-ended goal.
• Human control: every step approved → risky steps approved → mostly unattended.
• Adaptation: follows a plan → revises from observations → learns across runs.

These dimensions are independent. A long-running workflow may be deterministic. A one-turn request may still trigger a consequential model-chosen action. “More autonomous” is not automatically “better”; it often means a larger failure surface.

The top-right quadrant is not forbidden. It demands stronger identity, authorization, validation, approval, evaluation, monitoring, and recovery.

Four neighboring ideas you must separate

Model

The learned component that produces an output from inputs. It may generate text, structured data, or a proposed tool call.

Assistant

A user-facing application that helps someone. It may be a single model call, a workflow, an agent, or a mixture.

Workflow

Code determines the sequence. Models may fill individual steps, but the control flow is substantially predefined.

Agent

The model influences control flow at runtime: which action, which tool, which subtask, or whether the goal is complete.

One product can contain all four. Northstar’s chat interface is an assistant. Its refund eligibility check is a deterministic workflow. Its research module may be an agent. All call one or more models.

Misconception repair: “Agentic” describes behavior or architecture. It does not prove consciousness, agency in the moral sense, reliability, or business value.

I do: classify Northstar’s policy helper

Suppose the system receives a policy question, retrieves the three most relevant policy passages using fixed code, sends them to a model, and returns a cited answer.

1. Where is the path chosen? The application always retrieves, then generates.
2. Can an observation change the next operation? No; there is only the predefined sequence.
3. Can it act outside the conversation? No.
4. Classification: a model-powered retrieval workflow, not an agent loop.

This is not an insult. If it solves the task reliably, the simpler architecture is an advantage.

Now change one property: after reading the passages, the model may decide to search again with a revised query, ask the customer for a missing booking condition, or finish. It observes each result and chooses again. That version has agentic control flow.

We do: draw the boundary

Northstar proposes a booking-change feature. Complete this boundary card:

Suggested correction: the agent may identify intent, retrieve the relevant policy, and prepare an eligible change proposal. A customer must confirm price and itinerary before a narrow service commits it. The run stops after eight steps, two failed tool calls, a fixed cost budget, or unresolved ambiguity. The travel operations owner remains accountable.

You do: LAB-1 — Agent or not?

Choose three systems you know: perhaps email triage, expense approval, research, code review, scheduling, or customer support.

For each, record:

1. the goal;
2. the decision maker at each step;
3. available actions;
4. observations that can change the path;
5. consequence level;
6. permissions and approval gates;
7. stop conditions;
8. your classification and one-sentence justification.

Then design a simpler non-agent alternative. If you cannot explain why model-chosen control flow creates enough value to justify its risk and variability, choose the workflow.

Done when: another person can point to the exact location where runtime choice begins and the exact boundary where it ends.

Pause & Recall

Close the page. Answer from memory:

1. Why is the model alone not the agent?
2. What is the cleanest difference between a workflow and an LLM agent?
3. Name four independent dimensions of autonomy.
4. Why can a low-autonomy write operation be riskier than a high-autonomy research task?

Rate each answer 0-4. Reopen the relevant section only after attempting all four.

Production lens

Ambiguous language becomes operational risk. Before architecture work, write a task contract containing goal, inputs, outputs, permissions, prohibitions, approvals, stop conditions, success metrics, and owner. Do not accept “autonomous employee” as a specification.

Also separate authority from capability. A model may be capable of composing a refund request. Only authenticated policy code should decide whether the current user may submit one, and a separate service should enforce transaction limits.

Chapter compression

• A model generates; an agent system chooses and acts in a loop.
• A workflow’s path is coded; an agent’s path is partly chosen at runtime.
• Classical agents predate LLMs; specify which kind you mean.
• Autonomy is multi-dimensional, and more is not inherently better.
• The accountable boundary includes code, policies, tools, state, people, and operations—not just the model.

Memory hook: Model proposes; software disposes; people remain accountable.

Retrieval deck

• Q: What five elements appear in the smallest useful agent definition?
  A: Model-chosen action, goal, observation, adaptation, and human-designed boundaries.
• Q: What turns a fixed retrieval assistant into an agent?
  A: The model can use observations to choose a subsequent search, question, action, or finish decision.
• Q: Does tool access prove agenthood?
  A: No. A deterministic workflow can call tools, and a model can choose actions without broad access.
• Q: Who is accountable for an agent’s behavior?
  A: The people and organization that design, deploy, authorize, and operate the system.

Spaced review

• Now: rewrite your original definition in 25 words or fewer.
• +1 day: classify five products without rereading.
• +3 days: draw the system boundary for one risky action.
• +7 days: explain agent versus workflow to a nontechnical colleague.
• +14 days: inspect a new “agent” announcement and list what evidence is missing.

Sources and further study

• Russell & Norvig, Artificial Intelligence: A Modern Approach—intelligent agents overview
• Anthropic, Building Effective Agents—workflows versus agents
• OpenAI, A Practical Guide to Building Agents (PDF)
• ReAct: Synergizing Reasoning and Acting in Language Models