AI agents

In one paragraph

An assistant answers a question. An agent goes a step further and carries out a task: it looks something up in your systems, drafts the action that follows, and then stops for a person to approve it before anything final happens. The difference is not how clever the underlying model is, but what the system is allowed to do and how carefully that is bounded. A well built agent is defined as much by what it cannot touch as by what it can.

Why it matters

Letting a piece of software act on your systems, rather than only answer questions about them, raises the stakes of getting something wrong. An agent that can update a record, send a message, or trigger a process needs a boundary around what it is allowed to touch, a record of every step it takes, and a point at which a person checks its work before anything irreversible happens. Built this way, an agent can take on genuinely useful work while staying something a person can fully account for.

How it works

• An assistant reads a question and writes an answer. An agent goes further: it takes actions inside your systems on the way to completing a task.
• What an agent may touch is written down as a declared toolset, and it acts under its own named identity rather than borrowing anyone else's.
• Every step the agent takes, what it looked up, what it drafted, what it proposed, is logged, so the sequence can be reviewed afterwards.
• Before anything irreversible happens, such as sending a message or committing a change, the agent stops for a checkpoint where a person reviews and approves it.
• Where a step involves arithmetic or a rule based check, ordinary code does that part rather than the language model, because it is more reliable and easier to verify.

What the evidence says

• Reliability is the gap, not ability. In a benchmark where agents served simulated customers with real business tools under written policies, the agents tested completed fewer than half of the tasks, and solved the same retail task in all of eight attempts less than a quarter of the time.
• The work agents can take on is growing quickly. The length of task, measured by how long it takes a person, that leading agents complete half the time has doubled roughly every seven months since 2019.
• How an agent reaches tools and data is becoming a published standard. The open protocol for it requires that a person consents before any tool is run, and that a tool's own description of what it does is treated as untrusted unless it comes from a trusted source.
• Security bodies name the main risks plainly. An agent can be steered by instructions hidden inside the material it reads, and an agent given more permissions than its task needs can do real damage with them.

What it looks like in practice

Take a routine request to update a customer record, and an agent set up to handle it. The agent looks up the request, checks it against the relevant rules using ordinary code rather than guesswork, and drafts the change. Before the record is actually updated, the drafted change and the reasoning behind it are shown to a person, who approves or rejects it. Every one of those steps, the lookup, the draft, and the decision, is recorded, so the whole sequence can be reviewed later if anyone needs to.

How this connects to our work

Agents are what we build as supervised agents: durable workflows where the model proposes and the workflow decides, with a person approving what matters and a named identity and access boundary of their own. The technical detail is in agents and durable workflows.