Ask five vendors what an "AI agent" is and you will get five different answers — usually whichever one makes their product sound more advanced. So let's start with the simplest honest definition: an agent is software that can decide what to do next on the way to a goal, instead of following a fixed script.
A chatbot answers you. An automation runs a sequence someone wrote in advance. An agent is different: you give it an outcome — "find the double-booked reservations and draft the apology messages" — and it works out the steps, uses the tools it has been given, checks its own results, and comes back when the job is done or when it genuinely needs you.
The test is not whether it talks. The test is whether it can be trusted with the next decision — and whether it knows when to stop.
The three ingredients
Every real agent has three things. First, a brain: a language model that can reason about the situation. Second, hands: tools it is allowed to use — a calendar, a database, an email system, a browser. Third, and most overlooked, boundaries: permissions that define what it may touch, what it must ask about, and what it must never do.
Strip any one of these away and the word "agent" stops applying. A model without tools can only advise. Tools without reasoning are just automation. And reasoning plus tools without boundaries is not an employee — it's a liability with API access.
What agents are genuinely good at today
The honest list is shorter than the marketing list, but it is real: triaging and drafting communication, reconciling data between systems, monitoring for conditions and acting on them, preparing work for a human to approve, and running multi-step research that would eat someone's afternoon. The common pattern: bounded goals, clear tools, and a human checkpoint where the stakes are high.
How to spot the costume
When you evaluate anything sold as an agent, ask one question: "What decisions does it make without a human, and what happens when it gets one wrong?" If the answer is vague, you are looking at a chatbot in a costume. If the answer includes specific permissions, failure states, and an audit trail, you are looking at the real thing.
That is the standard we hold our own systems to — and the standard you should hold anyone to, including us.