AI agents explained: from prompt to plan, tools, and supervised action

Reviewed September 29, 2026. This article separates durable architecture concepts from product-specific features that may change.

A chatbot usually waits for a message and returns an answer. An AI agent can inspect a situation, decide what to do next, use a tool, read the result, and continue until it reaches a stopping condition. That extra loop turns language generation into a system that can affect files, databases, software, or other services.

The word agent is used loosely. Anthropic draws a useful architectural boundary: a workflow follows paths predefined in code, while an agent lets the model dynamically direct its process and tool use. OpenAI describes a basic agent through three core pieces: a model, tools, and instructions. These definitions overlap around one idea: the model is deciding some part of the next action rather than only filling in text.

Chatbot, workflow, or agent?

This distinction is a spectrum. A workflow may contain one agentic step, and an agent may still be surrounded by strict code. The useful question is: which decisions are delegated to the model, and which remain deterministic?

The agent loop, step by step

Observe
Read the task and state→Decide
Choose a next action→Act
Call an allowed tool→Evaluate
Inspect the result

1. Observe. The system assembles the user's request, instructions, relevant memory, available tools, and recent tool results.
2. Decide. The model proposes the next action. It might search a knowledge base, query an order, edit a file, ask a clarifying question, or stop.
3. Act. Application code validates the proposed call and invokes the tool with structured arguments. The tool performs the external operation.
4. Evaluate. The result returns to the model. The model checks whether it now has enough evidence or whether another step is needed.

A production system also needs state: what has already happened, what remains, and what must not be repeated. “Memory” can mean temporary conversation state, saved user preferences, retrieved documents, or a durable task record. These are different data stores with different privacy and retention requirements.

A concrete example: resolving a delayed order

Imagine a support request: “My package is five days late. Can you check it and tell me my options?” A chat-only model can draft a sympathetic response, but it does not know the order. A workflow can handle the request if every case follows the same rules. An agent becomes useful when the next step depends on what it discovers.

1. Ask for or securely resolve the order number.
2. Use an order tool to read payment and fulfillment status.
3. Use a carrier tool to inspect the latest scan.
4. Read the current delivery and refund policy.
5. Choose among “wait,” “replace,” “refund,” or “escalate,” within its granted authority.
6. Present the evidence and request approval before any consequential action that requires it.

The valuable part is not a human-like personality. It is the controlled connection between reasoning and verifiable actions.

When an agent earns its complexity

Anthropic recommends starting with the simplest solution and adding agentic complexity only when it demonstrably improves outcomes. That advice matters because every extra model call or tool creates another failure point.

Good candidates often combine unstructured input with a measurable finish: investigate why a test fails, gather evidence for a research brief, or triage a support case. A vague goal such as “run my business” lacks a bounded success condition and grants too much discretion.

Four failure modes to design for

1. A fluent plan can still be wrong

NIST uses the term confabulation for confidently presented false or erroneous generated content. Adding tools does not remove this property. An agent may call the wrong tool or interpret a correct result incorrectly. Require evidence for factual claims and validate structured outputs before use.

2. Tool access expands the impact of an error

A wrong paragraph is inconvenient; a wrong database update can be costly. Give each tool the smallest permission it needs. Separate read tools from write tools, cap transaction amounts, restrict directories, and require explicit approval for consequential operations.

3. External content can contain hostile instructions

A webpage, email, or document is data, even when it contains commands addressed to the model. The agent should follow trusted system and user instructions and treat retrieved content as untrusted evidence. Sensitive tools should never be activated merely because a document asks.

4. Long loops hide cost and drift

An agent can keep searching after it has enough information or repeat an unsuccessful action. Set maximum turns, time, and spending; detect repeated calls; and define conditions for stopping or escalating.

Human oversight should match the action

Oversight is more than adding an “Approve” button to every step. Anthropic's 2026 study of its own API traffic found that experienced users tended to approve more actions automatically while interrupting agents more often. The authors caution that the dataset covers one provider, but the result illustrates a useful design point: effective oversight combines sensible defaults, visibility, and an easy way to intervene.

• Low impact and reversible: allow execution, keep a visible log, and provide undo.
• External communication: preview the recipient and final content before sending when context or reputation matters.
• Money, access, deletion, or sensitive data: require scoped authorization and a clear approval step at the moment of action.
• Uncertain or out-of-policy: stop and ask rather than inventing permission.

Evaluate the system, not only the final prose

A good answer can hide a bad process, and a failed outcome can come from a correct model decision followed by a broken tool. Build an evaluation set from representative tasks and score multiple layers:

Start with tasks a human can judge. Include ordinary cases, missing information, conflicting documents, tool failures, and requests beyond the agent's authority. Then inspect traces: the sequence of decisions and tool results, not hidden internal reasoning.

A practical build checklist

The strongest agent is not the one allowed to do everything. It is the one that completes a well-defined job, shows what it did, and stops safely when the evidence or authority runs out.