# What is an AI agent? **AI agent** A goal-directed software system in which a model dynamically chooses steps and tools, observes results, updates working state, and continues until an exit condition or human handoff. technical-term · Foundations · maturing · Reviewed 2026-08-09 ## Definition An AI agent is a goal-directed software system in which a model dynamically chooses steps and tools, observes the results, updates its working state, and continues until it reaches an exit condition or hands control to a human. The model is only the reasoning component: a production agent also needs governed instructions, context, tools, identity, permissions, state, an execution harness, constraints, telemetry, evaluation, independent verification, and accountable human authority. The core loop is established, while architecture boundaries, assurance practices, and standards for consequential agents are still converging. ## Why it matters Agency begins when the model can select the next action from observed state rather than merely return one response along a fixed application path. The loop makes the system useful across uncertain, multi-step work—and also creates new failure surfaces because one model output can change the next context, tool call, or real-world effect. Enterprise readiness comes from the surrounding system: bounded standing, deterministic enforcement, independently owned checks, recorded evidence, and a named human disposition. An agent can be assistive, read-only, transactional, or consequential. “Agent” describes an execution pattern; it does not grant autonomy, authority, or trust. ## System anatomy - **Goal:** A bounded outcome and success condition the system is trying to reach. - **Model:** The probabilistic reasoning component that interprets state and proposes the next step. - **Instructions & policy:** Behavioral direction plus enforceable rules that constrain what actions may take effect. - **Context:** The selected information made visible for the current decision—not every available document. - **Tools:** Typed interfaces through which the agent can retrieve information or change an environment. - **Identity & standing:** An attributable non-human identity with purpose-bound, time-bound permissions conferred by governance. - **Working state & memory:** Task progress, observations, decisions, and durable knowledge carried across steps or sessions. - **Execution harness:** The runtime loop, checkpoints, retries, budgets, environments, and stop conditions around the model. - **Verification:** Deterministic and agentic checks, independently owned where acceptance or risk disposition is involved. - **Evidence & observability:** Attributable traces and artifacts showing inputs, decisions, actions, checks, approvals, and outcomes. - **Exit & human handoff:** A finite completion, block, escalation, or named human disposition—not an endless retry loop. ## Important distinctions - **Chatbot:** A chatbot primarily exchanges messages; an agent selects and executes steps against an environment. - **Agentic workflow:** A workflow follows largely predetermined control flow; an agent dynamically determines at least part of the path. - **Large language model:** A model predicts outputs from inputs; the agent is the surrounding goal-directed software system. - **Robotic process automation:** Traditional automation follows explicit rules; agents can choose among actions under uncertainty, within enforced bounds. - **Authority:** Technical ability to call a tool is not organizational standing to take the action. Governance confers standing; the control plane enforces its limits. ## Implementation signals - Start with the smallest degree of agency that can produce the intended value - Give every consequential action an attributable identity, purpose, scope, and expiry - Use typed, narrow tools and validate inputs and effects outside the model - Separate instructions from untrusted data and retrieved content - Combine deterministic checks with independent agentic verification - Define budgets, retries, completion, hold, escalation, and stop paths before runtime - Preserve an evidence chain from intent through human disposition and production outcome - Reclassify and recertify when models, tools, data, owners, or impact change ## Failure modes - An open-ended loop that retries without new evidence or a finite stop condition - Tool access being mistaken for permission or business authority - The same model lineage building and independently accepting its own output - Retrieved or user-authored content overriding trusted instructions - Long contexts hiding stale, contradictory, or irrelevant state - Rich traces with no tested path to block, hold, revoke, or escalate - A named agent remaining active after purpose, owner, or authorization expires ## Related knowledge - [Agent loop](https://aisdlc.ai/agentic-engineering/agent-loop) — The finite runtime cycle in which an agent interprets state, selects an action, observes the result, updates state, and decides what happens next. - [Agentic system](https://aisdlc.ai/agentic-engineering/agentic-system) — A software system that delegates some path selection or action choice to one or more model-driven agents within an engineered operating boundary. - [Harness engineering](https://aisdlc.ai/agentic-engineering/harness-engineering) — Engineering the agent loop, task decomposition, tools, permissions, session state, checks, retries, feedback, checkpoints, and stop conditions that surround a model. - [Agent identity & delegated authority](https://aisdlc.ai/agentic-engineering/agent-identity) — The identity and authorization discipline that treats an enterprise agent as a non-human principal with attributable, purpose-bound, time-bound permissions. - [Deterministic containment](https://aisdlc.ai/agentic-engineering/deterministic-containment) — The enforcement envelope outside the model: isolation, deny-by-default access, typed allowlists, quotas, transaction ceilings, network boundaries, timeouts, rollback, quarantine, and tested stop controls. - [Independent verifier systems](https://aisdlc.ai/agentic-engineering/multi-agent-verification) — A separation-of-judgment architecture in which builder agents, evaluator agents, deterministic checks, domain experts, and authorization authorities challenge different failure surfaces. - [Human accountability](https://aisdlc.ai/agentic-engineering/human-accountability) — The operating discipline that assigns a named human role authority and answerability for an agent’s purpose, risk, decision rights, authorization, intervention, outcomes, and lifecycle. ## Sources and further study - [Anthropic — Building effective agents](https://www.anthropic.com/engineering/building-effective-agents) — A foundational distinction between fixed, code-orchestrated workflows and systems in which a model dynamically directs its process and tool use. **Use:** Primary definition. **Limitation:** The workflow-versus-agent distinction is a useful architecture boundary, not a universal taxonomy or proof that autonomous execution is preferable. - [Anthropic — Trustworthy agents in practice](https://www.anthropic.com/research/trustworthy-agents) — Describes a self-directed plan–act–observe–adjust loop and the engineering layers needed to make longer-horizon agents more trustworthy. **Use:** Primary definition. **Limitation:** This first-party synthesis describes design directions and failure surfaces; it is not a certification scheme or evidence that every described control is sufficient. - [OpenAI — A practical guide to building agents](https://openai.com/business/guides-and-resources/a-practical-guide-to-building-ai-agents/) — Defines a practical agent around a model, tools, instructions, and a run loop that continues until an exit condition is reached. **Use:** Primary definition. **Limitation:** The guide is first-party product guidance and a simplified starting architecture, not a complete regulated-enterprise control model. - [arXiv / ICLR — ReAct: Synergizing Reasoning and Acting in Language Models](https://arxiv.org/abs/2210.03629) — Studies interleaved reasoning traces and environment actions, a foundational pattern for model-driven agent loops. **Use:** Primary definition. **Limitation:** Reported benchmark gains do not establish reliability for open-ended production environments or permission for consequential action. - [NIST NCCoE — Identity and Authority for Software Agents concept paper](https://www.nccoe.nist.gov/sites/default/files/2026-02/accelerating-the-adoption-of-software-and-ai-agent-identity-and-authorization-concept-paper.pdf) — A concept paper exploring how established identity and authorization practices can apply to software and AI agents. **Use:** Official guidance. **Limitation:** Guidance describes recommended practice; citation does not prove that a control is implemented or effective in a particular environment. - [Peter Yang — 5 Rules for Building AI Agents That Work in Production | Nan Yu & Jacob Shumway](https://www.youtube.com/watch?v=4mKtJzfGj0U) — A Linear engineering discussion of production agents, tool design, context loading, feedback, evaluation, and simple model-in-a-loop explanations. **Use:** Practitioner perspective. **Limitation:** The five rules and “LLM in a loop plus tools” shorthand reflect one product team’s experience; they are not a standard or a complete enterprise-agent definition. --- This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.