Agentic AI describes systems in which a model helps control a multi-step process: interpreting a goal, selecting tools, observing results, adapting the plan, and stopping or escalating under defined conditions. A chatbot, classifier, scripted automation, or predictive model is not necessarily an agent.

Agents and workflows

In a workflow, code determines the path; in an agent, a model dynamically chooses actions within guardrails. Dependable systems often combine deterministic steps with bounded agentic decisions. Compare AI workflow automation.

Production agents pursue operator-defined objectives. Tool permissions, budgets, timeouts, retry limits, confirmation rules, logs, and escalation should bound intermediate choices. Most do not update model weights during a run; adaptation usually means using context, state, retrieval, or feedback.

Core architecture

  • Model: interprets state and proposes an action.
  • Tools: expose narrow read or write capabilities.
  • Policy: constrains behavior and escalation.
  • State: carries necessary information across steps.
  • Run loop: stops on success, failure, limit, or handoff.

Where agents fit

Agents suit tasks requiring judgment over unstructured information, multiple tool calls, and adaptation to results. Deterministic workflows remain preferable when rules are stable, reproducibility is essential, or errors are costly.

  • Service operations with permitted changes and exception handoff.
  • Research across approved sources with an auditable draft.
  • Software delivery with tests and bounded changes.
  • Security enrichment, with authorization for destructive containment.

Evaluation

Evaluate the complete system across normal, edge, adversarial, tool-failure, permission, and escalation cases. Measure task success, action arguments and order, policy adherence, repeated-run reliability, latency and cost, stopping behavior, reversibility, and human review burden. Trace-level evidence matters because a polished answer can conceal a wrong action. See LLM evaluation metrics and AI hallucination.

Predictive AI is different

AlphaFold is a landmark structure-prediction system, but prediction alone does not make it an autonomous tool-using agent. Its outputs require confidence measures and domain expertise. The same distinction applies to classifiers, forecasters, and recommenders.

A bounded research-agent pattern

import os
from openai import OpenAI

client = OpenAI()
response = client.responses.create(
    model=os.environ["OPENAI_MODEL"],
    tools=[{"type": "web_search"}],
    input=("Research this topic using authoritative sources. Separate facts "
           "from inference, note uncertainty, cite links, and take no external actions: "
           + input("Topic: ").strip()),
)
print(response.output_text)

The application fixes the objective, available capability, and output boundary while the model may decide how to search. Production versions need allowlists where appropriate, time and cost limits, schema validation, tracing, test sets, and approval before consequential writes.

Guardrails are system controls

Prompts are not security boundaries. Use least-privilege credentials, server-side authorization, constrained schemas, validation, logging, rate and spend limits, sandboxing, confirmation for consequential actions, and a reliable human handoff. Treat retrieved content and tool output as untrusted input.

An AI governance framework should connect these controls to ownership, risk classification, monitoring, incident response, and change management. The goal is useful delegation with evidence and bounded authority—not maximal autonomy.