Agentic AI & AI Agents
An AI agent does not just answer a question. It works out the steps, uses tools and systems to carry them out and checks its own progress. That makes it powerful, and it makes permissions, oversight and audit more important than ever.
An AI agent is a helper that does not just tell you how to do a task but actually clicks the buttons and does it, so you have to be careful what you let it touch.
The short version, in a few minutes.
A plain-English walkthrough of this page. Prefer reading? Everything in the video is covered below.
What it is
A chatbot answers. An agent acts. Agentic AI uses a large language model to break a goal into steps, choose tools, carry out each step and adjust based on what happens. The tools might be a web search, a database query, a spreadsheet, an email draft or an action in your CRM, ERP or ticketing system.
Agents range from narrow and tightly controlled, such as an assistant that drafts replies to supplier queries for a person to approve, to broad and autonomous, such as a coding agent that writes, tests and submits changes. Most business value today comes from the narrow end: well-defined tasks, a limited set of tools and clear points where a person checks the work.
How it works
An agent runs in a loop. The model reads the goal and the context, decides on the next action, uses a tool, reads the result and decides again, until the task is done or it needs help. The software around the model controls which tools are available, what each one is allowed to do, how long the agent can run and when it must stop and ask a person.
The Model Context Protocol (MCP) is an open standard for connecting AI applications to tools and data. Introduced in late 2024 and now supported across the major AI platforms, it lets you expose a system once, through an MCP server, and use it from different AI tools instead of building a separate integration for each. MCP makes connecting easier. It does not decide what an agent should be allowed to do, so sign-in, permissions and logging still have to be designed.
Where it creates real value
- Multi-step back-office work. Gather information from several systems, prepare a draft and hand it to a person to approve.
- Customer and supplier queries. Look up orders, stock or account details and draft an accurate reply, escalating anything unusual.
- Research and preparation. Pull together documents, data and notes before a meeting, a bid or a review.
- Software and IT tasks. Write and test code, investigate incidents or carry out routine changes under human review.
- Investigating exceptions. Work out why an order, payment or delivery failed and propose the fix, so people decide instead of digging.
Where it's commonly misapplied
- Too much autonomy too soon. Letting an agent act unsupervised on payments, customer records or live systems before it has earned trust is how small errors become big incidents.
- Over-broad permissions. An agent given an administrator account can do anything that account can do, including things nobody intended.
- A fixed process in disguise. If the steps never change, ordinary automation is cheaper, faster and more predictable than an agent.
- Trusting what it reads. Emails, web pages and documents can contain hidden instructions, and an agent that follows them can leak data or take harmful actions.
- Believing its summary. Agents can report success when a step quietly failed, so check results in the systems themselves.
Give agents a job, not the keys.
Treat each agent like a new member of staff with its own identity. Give it the narrowest permissions that let it do its job, prefer read-only access where you can, and require human approval for anything that cannot be undone, such as payments, deletions or messages to customers. Connect it through controlled interfaces such as APIs and tightly scoped MCP servers, and keep passwords and keys out of the model's reach.
Log every step: what the agent was asked, what it read, which tools it used and what changed. That audit trail is essential for fixing problems, for security and for accountability. Set limits on run time, number of steps and spend, because agents can loop and every step costs money. Test against realistic failures, including tool errors, bad data and deliberate prompt injection, and keep monitoring once the agent is live.
What this means for your organisation.
Start where an agent prepares and a person decides. A draft reply, a reconciled report or a proposed fix gives you much of the time saved with little of the risk. As evidence builds that an agent is reliable at a task, widen what it can do on its own, one step at a time.
Agents also change who is accountable. Decide in advance who owns each agent, who reviews its work and who can switch it off. Many software suppliers are now adding agents to their products, so ask the same questions of agents you buy as of agents you build.
Questions to ask your team or vendor
- What exactly can this agent read, change and send, and under whose identity?
- Which actions need a person to approve them, and how is that enforced?
- Where is every step logged, and who reviews the logs?
- How does it defend against hidden instructions in emails, documents or web pages?
- What limits stop it looping, overspending or running too long?
- How do we switch it off, and what happens to work in progress when we do?
How it connects to the rest.
Generative AI
Agents are built on the same large language models that power generative AI.
Explore →Intelligent Automation
Use fixed automation for predictable steps and agents for the parts that need judgement.
Explore →LLMs & Retrieval (RAG)
Agents rely on retrieval to find the right documents and data before they act.
Explore →Responsible AI
Oversight, accountability and audit are what make agents safe to use at work.
Explore →I work with APIs and MCP servers, and I design agent integrations with tight permissions and a full audit trail from the start. See my AI security work, or bring me in to help your team build agents safely.
What is the difference between a chatbot and an AI agent?
A chatbot responds to what you type. An agent can take actions: look things up in your systems, update records, prepare drafts or run tasks, often over several steps. That extra power is why agents need tighter controls.
What is MCP, and do we need it?
The Model Context Protocol is an open standard for connecting AI tools to systems and data. It helps when you want several AI tools to reach the same systems without a separate integration for each. It is a connector, not a security model, so permissions and logging still need designing.
Are AI agents ready for business use?
For well-defined tasks with limited tools and human review, yes, and many organisations use them that way. Fully autonomous agents doing consequential work without oversight are still risky. Start narrow and widen as the evidence builds.