What Is an "Agent"?

The word does work: agency is delegated authority to act

“Agent” descends from the Latin agere — to do, to drive, to act — and the cognate noun agency carries the sense the software term inherits, the authority to act on someone else’s behalf.¹³ The economics literature makes the delegation explicit. NBER defines AI agents as “autonomous software systems that perceive, reason, and act in digital environments to achieve goals on behalf of human principals,” and is careful to spell out that “principal” means “any stakeholder that deploys AI agents.”⁶ This is the classical principal-agent relation transplanted into software. A principal grants an agent authority to pursue a goal, and the agent exercises judgment within that grant.

For a lay reader, the grant carries the whole definition. Moving from single-step prompting to an agent means moving from a human in the loop at every step to handing the system authority over a multi-step process. OpenAI’s product definition lands in the same place: “agents are systems that independently accomplish tasks on your behalf,” performing workflows “with a high degree of independence.”² Everything mechanical in the sections below exists to execute that delegated grant.

Three levels of definition: the agent system, the deliberative species, and the run

Agency gives the word its meaning, and the definition still needs structure, because “agent” gets used at three different grains: the kind of system, the subkind that deserves the name in argument, and the single execution. Three levels resolve that. An agent system, the genus, is any perceive-decide-act configuration of model, instructions, tools, memory, and a harness, individuated by its configuration and instructions. A deliberative agent system, the species, is picked out by the act-or-answer branch, where the decider is a general reasoner that, at each step, composes an open-ended action and chooses whether to act again or to answer. A run, the instance, is one realised trajectory, individuated by the path taken. No single source states the taxonomy in this form; the components the sources supply populate it.

The species boundary carries the practical weight, because agent-versus-workflow is the call builders and buyers actually face. Anthropic draws the cut architecturally: “workflows are systems where LLMs and tools are orchestrated through predefined code paths,” whereas “agents… are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks.”¹ The test underneath, which this paper will call the locus-of-decision test, runs as follows: one reasoning step plus one action is still a deliberative agent if the model chose to stop, and it is a workflow if the code decided the stop. Step-count plays no part; who holds the branch is the whole of it. OpenAI states the same test in product terms — an agent “leverages an LLM to manage workflow execution… recognizes when a workflow is complete and can proactively correct its actions,” and “dynamically selects the appropriate tools depending on the workflow’s current state”² — and NBER gives the operational version, asking whether the system “autonomously define[s] or pursue[s] tasks” rather than merely automating retrieval over “pre-supplied data.”⁶

The genus lines up with Anthropic’s own umbrella term, and saying so removes an ambiguity the taxonomy would otherwise carry. Anthropic gathers “all these variations” under agentic systems, with workflows and agents as the two kinds inside it.¹ The genus makes the same move at the same level. A workflow is an agent system, a perceive-decide-act configuration, that fails the species test, because its code path holds the branch. So the workflow stays inside the genus and falls outside the species, and the exclusions later in this paper operate at the species level.

The run level earns its place through a consequence. Because the decider is probabilistic, two runs of the same system on the same instructions diverge in trajectory, the way two people given the same brief produce different working paths. Identity therefore attaches to the path. A test that certifies one run has certified one trajectory through the system, and governing a deliberative agent means watching runs, since the system’s behaviour is a distribution over paths. When a later section says high agency has to be scoped and monitored, this is the level at which the monitoring happens.

The genus is thirty years old: a rational agent with an LLM as the decision function

The genus predates the current boom by three decades. Russell & Norvig’s canonical definition — an agent is “anything that can be viewed as perceiving its environment through sensors and acting upon that environment through actuators” — was written for the pre-LLM field, and it is the definition every lab and vendor formulation echoes.¹³ The behaviour of such an agent is formally an agent function mapping a percept sequence to an action, and a rational agent “always choose[s] the action that maximizes the expected value of the performance measure, using only the knowledge they currently have.”¹³ Rationality in this frame means good action selection under limited knowledge. Omniscience was never part of the offer.

Chip Huyen’s synthesis makes the inheritance explicit, quoting the same perceive-act line and defining an agent as “anything that can perceive its environment and act upon that environment.”¹⁰ An agent is then characterised by “the environment it operates in and the set of actions it can perform,” where “the set of actions an AI agent can perform is augmented by the tools it has access to.”¹⁰ Read across the two sources, the mapping lands cell by cell. The LLM is the decision function, tools are the actuators, the context and inputs are the percepts, and the goal supplies the performance measure. The modern agent is the rational-agent framework with an LLM in the chooser’s seat.

Five parts populate the genus: model, instructions, tools, memory, and a loop

Across independent sources the parts list is stable; only the labels move. Anthropic’s version is the fullest. Its atomic unit is “the augmented LLM,” a model “enhanced with augmentations such as retrieval, tools, and memory” that can use those capabilities itself, and mechanically “agents are typically just LLMs using tools based on environmental feedback in a loop.”¹ The other breakdowns confirm the same shape under different groupings — OpenAI’s minimal agent is Model, Tools, and Instructions;² Google’s “cognitive architecture” is a model, tools, and an orchestration layer that cycles “until an agent has reached its goal or a stopping point”;⁵ Lilian Weng’s widely cited formula is “Agent = LLM + memory + planning skills + tool use.”⁹

Synthesised, five elements recur. A model decides; instructions constitute and bound behaviour; tools connect the model to the external world; memory spans the in-context working set and external long-term stores;⁹ and a harness runs the perceive-decide-act loop until a stopping point. Two of the source labels deserve a word each. Memory is the component the vendor three-part models fold into “orchestration” and the one Weng makes first-class, splitting it into short-term (the context window) and long-term (an external vector store retrieved on demand).⁹ Planning, the other first-class citizen in Weng’s formula, has no separate box in the five-part scheme because it lives inside two of the parts: task decomposition, where “the agent breaks down large tasks into smaller, manageable subgoals,” is work the model does in its own reasoning, and reflection, the “self-criticism and self-reflection over past actions,” is what the loop’s feedback step exists to carry.⁹

The tools element also fixes what the agent is. Huyen states the dependency in both directions: “the environment determines what tools an agent can potentially use… however, an agent’s tool inventory restricts the environment it can operate in.”¹⁰ Give the same model a different tool set and you have changed the worlds it can act in, which is why the taxonomy individuates the genus by configuration and instructions. The model alone underdetermines what the system is; the anatomy, in other words, is the identity.

The species has a research origin: reasoning interleaved with action

The act-or-answer loop at the centre of the species came out of primary research. ReAct showed that an LLM could “generate both reasoning traces and task-specific actions in an interleaved manner,” where “reasoning traces help the model induce, track, and update action plans as well as handle exceptions, while actions allow it to interface with and gather additional information from external sources.”³ The paper’s human analogy is cooking. Between two physical actions a person reasons in language, tracking progress and adjusting the plan when an ingredient is missing.³ That thought, action, observation cycle is the concrete shape of the loop the lab and vendor literature describes in prose, and it produced real gains, beating imitation and reinforcement-learning baselines by 34% and 10% absolute on two interactive benchmarks with only one or two in-context examples.³

Toolformer supplied the other half, the finding that the model can direct its own tool use. It was “trained to decide which APIs to call, when to call them, what arguments to pass, and how to best incorporate the results,” learned self-supervised, “requiring nothing more than a handful of demonstrations for each API.”⁴ For the definition, the significance is that self-directed tool use existed as a property of the model before anyone standardised it as a protocol.⁴ Google’s whitepaper closes the lineage by requiring that an agent’s model be able to follow reasoning frameworks “like ReAct, Chain-of-Thought, or Tree-of-Thoughts,” naming the research the loop descends from.⁵

The chatbot, the copilot, and the script all fail the same test

A definition is only useful if it excludes things, and the sources are explicit about the exclusions. OpenAI states it flatly: “applications that integrate LLMs but don’t use them to control workflow execution — think simple chatbots, single-turn LLMs, or sentiment classifiers — are not agents.”² Its fraud-analysis analogy carries the contrast in one image. “A traditional rules engine works like a checklist, flagging transactions based on preset criteria,” whereas “an LLM agent functions more like a seasoned investigator, evaluating context, considering subtle patterns.”² The rules engine, and with it scripted automation and RPA, fails the locus-of-decision test because the code path holds the act-or-answer branch. Anthropic’s matching guidance is to choose a workflow “for well-defined tasks where predictability and consistency are needed” and an agent only “when flexibility and model-driven decision-making are needed at scale.”¹

The copilot is the hardest near-miss, so the test is worth running on it rather than asserting past it. A copilot embeds a capable model inside a human’s working session, drafting and suggesting, while the human accepts or rejects each suggestion and decides when the work is done. Run the test and the branch sits outside the model. The surrounding application and the human hold the control flow and the stop, which places the copilot in OpenAI’s excluded class — applications that integrate LLMs but “don’t use them to control workflow execution”² — and under NBER’s test it “does not autonomously define or pursue tasks.”⁶ The model inside a copilot may be identical to the model inside an agent. The grant of authority differs, and the grant is what the definition measures.

NBER’s own prototype example shows the same test admitting a system. Deep Research, “unlike traditional software, which retrieves information or processes only pre-supplied data,” “takes natural language instructions (prompts) and independently carries out actions to produce a researched report,” and “can iteratively search the web, evaluate results, and assemble a report without human oversight at each intermediate step.”⁶ The model chooses the next search, evaluates what came back, and decides when the report is done, so the branch sits with the model and the system clears the species line. An upload-and-summarise tool, in NBER’s own contrast, keeps the reasoning with the user and stays outside.⁶

Google’s agents-versus-models contrast catalogues why a bare model, queried directly, fails the test on four axes at once.

The exclusions run in both directions, because the same boundary tells a buyer when the species is worth building at all. OpenAI’s guidance points agents at the workflows that resisted rule-based automation: complex decision-making involving “nuanced judgment, exceptions, or context-sensitive decisions”; rules systems “that have become unwieldy due to extensive and intricate rulesets, making updates costly or error-prone”; and work that leans on unstructured data, “interpreting natural language, extracting meaning from documents, or interacting with users conversationally.”² Otherwise, on OpenAI’s own advice, “a deterministic solution may suffice.”²

Autonomy is a dial on the species, set apart from capability

With the species defined, autonomy can get its own axis, because a persistent confusion treats “agent” as a binary and “autonomous” as a synonym for “powerful.” The Knight Institute framework separates the axes: “an agent’s level of autonomy can be treated as a deliberate design decision, separate from its capability and operational environment.”¹¹ It defines five escalating levels by the role the human takes — operator, collaborator, consultant, approver, observer — across which “user involvement decreases” as “agent autonomy increases.”¹¹ The same capable model can be deployed at any rung. How much rope it gets is a governance decision.

Capability, meanwhile, is set elsewhere in the anatomy. Huyen’s summary is that “the success of an agent in an environment depends on the tool it has access to and the strength of its AI planner,“¹⁰ so what an agent can do is fixed by its tools and its reasoning, while how freely it may act is fixed by the level its principal chooses. On the dial itself she reaches the compatible conclusion that autonomy is best defined per-action, with “humans… involved at any stage to aid with the process and mitigate risks.”¹⁰

Risk rises with the dial, so high agency belongs in narrow scopes

The definition is what makes the dial governable. Until you know whether the model or the code holds the act-or-answer branch, you cannot say what authority you have delegated, and delegated authority is the quantity the risk literature prices. The Hugging Face dissent argues its position in its title — fully autonomous AI agents should not be developed — and supports it with a monotonic claim: “risks to people increase with the autonomy of a system: the more control a user cedes to an AI agent, the more risks to people arise.”⁷ Agents sit “on a sliding scale of autonomy, where risks outweigh benefits for systems at the upper end (full autonomy),” and the most dangerous form is one “capable of writing and executing their own code beyond predefined constraints,” which “enables the potential to override human control.”⁷ The paper’s favoured alternative is semi-autonomous systems “which retain some level of human control,” with the right level depending on “the complexity of tasks assigned, and the nature of human involvement.”⁷

Read together with the Knight levels, the dissent yields a transferable architectural principle. Autonomy is dialable, and risk follows the dial, so a high-agency component should be narrowly scoped and a broad-scope component should stay low-agency. The dangerous quadrant is high agency and broad scope at once. The safer pattern pairs a broad, low-agency coordinator with narrow, higher-agency specialists, which keeps each high-agency part testable and constrained. One caution belongs here. A coordinator that produces judgment and delegates is structurally different from an individual contributor that produces work with sub-agents underneath it. The production model differs, so one cannot be modelled as a scaled-up version of the other.

MCP made the tools leg portable

If an agent is model, instructions, tools, memory, and loop, the practical bottleneck was always the tools leg, because every integration was bespoke. Anthropic’s Model Context Protocol, announced November 2024, is “an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools,” motivated by the observation that “even the most sophisticated models are constrained by their isolation from data — trapped behind information silos and legacy systems.”⁸ Its contribution is to replace “fragmented integrations with a single protocol.”⁸ Restated, that collapses an M×N integration problem, every model wired separately to every tool, into N+M, with tools exposing one MCP server and models speaking one MCP client. Toolformer had already shown self-directed tool use was a model capability;⁴ MCP made exercising it portable across models and vendors, which is much of why “agent” moved from research demo to something buildable at scale.

”Agent washing” scales the definitional failure into a procurement problem

Definitional discipline matters because the market is actively eroding it. Gartner coined “agent washing” for “vendors rebranding existing chatbots and automation tools — including AI assistants and robotic process automation (RPA) — as agentic AI without delivering genuine autonomous capabilities,” and estimates that “of the thousands of vendors claiming agentic solutions… only around 130 offer real agentic features.”¹² The projects built on the mislabelled products fare accordingly. On a poll of 3,400-plus organisations, Gartner predicts “more than 40% of agentic AI projects will be canceled by the end of 2027,” attributing failure to “escalating costs, unclear business value, or inadequate risk controls” and to organisations “deploying agents without a clear strategy… or the governance to manage what happens when something goes wrong.”¹² Gartner analyst Anushree Verma puts the state of practice in one sentence, as reported: “Most agentic AI projects right now are early-stage experiments or proof of concepts that are mostly driven by hype and are often misapplied.”¹²

A rebranded chatbot or RPA script is the negative case the species already excludes, since its code path holds the branch. “Agent washing” is therefore the locus-of-decision failure scaled up to a procurement problem, and the buyer who cannot run the test cannot see the washing.

The delegation reading: an agent is a new kind of talent, grown into the system

Compressed to its load-bearing parts, the definition runs in one movement. An agent holds delegated authority; the thing that exercises the authority is a perceive-decide-act system; the system earns the name when the model holds the act-or-answer branch — one reasoning step plus one action is still a deliberative agent if the model chose to stop, and a workflow if the code decided the stop¹⁶ — and each exercise of the authority is a run whose identity is its path. Autonomy is then a governance dial set on top,¹¹ and risk follows the dial.⁷

The word ends where it began, in delegation, and the delegation reading changes what kind of thing an agent is inside an operating model. Read as a tool, an agent is a strange one. It exercises judgment inside a granted scope, and it varies between runs the way two people vary given the same brief. Read as talent, both properties are ordinary. That is the position this paper takes: agents are a new kind of labour, a capacity to which work is delegated, and the join between that capacity and the system employing it is grown rather than bolted. An AI-native operation is a structural pattern in its own right, and growing that shape is different work from wiring agents onto the shape you already have.

The design question that follows is the delegation question — what authority is being granted, over how broad a scope, and who decides when it stops.

References