Ask five people in this industry what an agent is and you will get four answers plus someone insisting the question is not interesting. That is not a sign of an immature field so much as a sign of a word doing commercial work. The definitions in circulation are genuinely incompatible, and knowing which one is in play is the difference between evaluating a product and being sold one.
The workable definition
An agentic system is one where the model decides what to do next — choosing actions, ordering them and determining when the task is complete — rather than executing a sequence a developer wrote.
The test is not sophistication or tool access. It is who owns the control flow.
Four definitions in active use
These are all in current circulation, and none is dishonest on its own terms. The trouble is that they are used interchangeably.
| Definition | Qualifies as an agent | Who favours it |
|---|---|---|
| Anything with tools | A chatbot that can search | Marketing |
| Loop with model-controlled exit | A system that iterates until done | Engineers |
| Runs unsupervised for long stretches | Hours of independent work | Researchers |
| Goal-directed with real autonomy | Sets its own subgoals | Academia, older AI |
The first is why the word is losing meaning: under it, a search box with a model attached is an agent, and so nearly everything is. The fourth is strict enough that very little currently shipping qualifies. Most useful engineering conversation happens under the second.
⚠️ The definitional slide to watch for
A common pattern in product material: claim the capability of the fourth definition, describe the architecture of the second, and ship the first. Each individual sentence is defensible; the combination is not.
The question that collapses it: "How many model calls happen without a human or a developer-written rule deciding the next one?" If the answer is one, it is a model call with a tool, whatever the brochure says.
Five properties that actually distinguish
Rather than arguing about the label, describe the system. These five are what people are gesturing at, and they can be checked.
1. Goal-directed rather than instruction-following
Given "reduce the size of every image in this folder to under 200KB", an instruction-following system does what you said. A goal-directed one works out that some images need resizing, others recompressing, and one is already small enough to skip.
2. Acts in external systems
Something changes outside the conversation — a file written, a message sent, a record updated. A system that only produces text has no agency in any meaningful sense, however clever the text.
3. Runs a loop
More than one round of decide-act-observe. A single call with a tool, then an answer, is not a loop.
4. Decides its own termination
This is the property that most reliably separates categories, and the one most often missing.
5. Adapts to what it finds
When a step fails or returns something unexpected, the system changes approach rather than proceeding as if it had not happened. Without this, a loop just repeats a mistake more expensively.
💡 Score it instead of labelling it
Five properties, five yes-or-no answers. A system with all five is agentic under any definition worth using. One with two or three is where the arguments live — and describing which two is far more informative than the word.
"It loops and adapts, but every action needs approval and the goal is fixed" tells you exactly what you are dealing with. "It's agentic" tells you nothing.
The autonomy spectrum
Autonomy is not binary, and the useful version of the question is how much, over what.
Level 3 is where most well-built production systems sit, and that is not a failure of ambition. The confirmation boundary on consequential actions is what makes the system safe to run at all — it is the control that holds when prompt injection succeeds, and injection will sometimes succeed.
Level 5 is worth naming precisely because it is where the marketing points and almost nothing actually operates. A system that selects its own objectives is not primarily an engineering problem; it is a governance one, and the industry has not solved either part.
Why the term arrived when it did
Agents are an old idea in AI — the goal-directed autonomous entity predates language models by decades. Three things changed recently enough to make the old idea buildable:
- Reliable structured output. An agent loop needs the model to emit a parseable action every time, not usually. Constrained decoding made that dependable rather than probabilistic.
- Tool calling as a first-class feature. Standardised tool interfaces turned "get the model to trigger an API" from a parsing exercise into an interface.
- Context windows large enough to hold a trajectory. A loop accumulates every action and result. At 4,000 tokens that is a handful of steps; at 200,000 it is a working session.
None of these is an increase in reasoning. They are plumbing — which is why capable agentic systems appeared quite suddenly across the industry rather than tracking any single model release.
Questions that cut through
When evaluating something described as agentic, these five get you to the substance faster than any amount of documentation:
| Ask | Because |
|---|---|
| How many model calls per task, typically? | One means it is not looping |
| What decides that it is finished? | A counter is not autonomy |
| What can it do without asking me? | This is the real risk surface |
| What happens when a step fails? | Adaptation vs blind continuation |
| What does a run cost, worst case? | Unbounded loops have unbounded bills |
The last one is the most revealing in practice. A vendor who cannot tell you the worst case has not bounded it, which means neither the cost nor the behaviour is under control.
🚨 Autonomy is a cost, purchased for a reason
Every increment of self-direction trades away predictability, testability and bounded spend. That trade is worth making when you genuinely cannot enumerate the steps in advance.
When you can — and for most business processes you can — you have paid the full price and received nothing. Build the workflow, ship it, and let the specific cases it fails on justify the loop.
A better question than "is it an agent"
The label was never going to settle, because too many people benefit from it staying loose. What settles is description.
Ask instead: what decisions has this system been given, and what happens when it gets one wrong? That question has a concrete answer for every system, it exposes the actual risk surface, and it cannot be answered with a category name. It is also the question you will wish you had asked when something misfires at three in the morning.
Building agent pipelines that move files around?
Convert, inspect and clean files entirely in your browser — nothing is uploaded to a server.
Browse all tools →Summary
- Four incompatible definitions are in active use, from "has tools" to "sets its own goals".
- The workable test is who owns the control flow — your code or the model.
- Five properties describe a system better than a label: goal-directed, acts externally, loops, self-terminates, adapts.
- Self-termination is the property most often missing and the most diagnostic.
- Autonomy is a spectrum. Level 3 — free action, approval for consequential ones — is where good systems sit.
- Agents became buildable through plumbing, not a leap in reasoning.
- Ask the worst-case cost. No answer means nothing is bounded.
- The better question is what decisions it holds and what happens when it is wrong.
Frequently Asked Questions
What is agentic AI?
Broadly, an AI system that pursues a goal by deciding its own actions rather than following steps written by a developer. The disagreement is over how much self-direction qualifies, which is why the term is applied to everything from a single model call with one tool to a system that runs for hours without supervision.
What is the difference between an AI agent and a chatbot?
A chatbot produces text in response to input. An agent takes actions in external systems and uses the results to decide what to do next. The dividing line is whether anything happens outside the conversation as a consequence of the model's output.
Is a chatbot with tools an agent?
By most working definitions, not on its own. Calling a tool and then answering is an augmented model call. It becomes agentic when the model runs in a loop, evaluating each result and deciding whether to act again — the model-controlled loop, not the tool access, is what changes the category.
What are the properties of an agentic system?
Five recur across serious definitions: goal-directedness rather than instruction-following, action in external systems, a loop that runs more than once, model-controlled termination, and adaptation based on results. Systems with all five are unambiguously agentic; systems with two or three are where the arguments happen.
Is agentic AI just marketing?
The term is heavily marketed, but it names something real. Systems where the model decides its own control flow behave differently from systems where a developer wrote the sequence — different costs, different failure modes, different testing needs. The substance is real even where a particular product's claim to it is not.