The dividing line in one sentence
A chatbot produces text. An agent operates tools, and looks at the results of its own work.
Ask a chatbot whether you are free next Tuesday morning and you get a polite answer explaining that it has no access to your calendar. An agent opens the calendar, looks, and tells you.
How it actually works
An agent runs in a loop, not in a single step:
- It looks at where it has got to and decides what the next step is.
- It calls a tool — searches, reads a file, calls an API, runs a program.
- It reads what came back.
- If it is not what it expected, it tries a different way. If it is good, it moves on.
- When it is finished, it summarises.
Step three is the point, and it is what the chatbot lacks. The agent sees the result of its own work and can react to it. That is what lets it fix a faulty query without you having to say anything.
What makes it able to use a tool at all?
The model does not "do" anything. What it can do is produce a structured request — for example, "call the calendar lookup for this date range". That request is executed by the program around it, which hands the result back to the model.
So an agent is not a smarter model, it is a program built around a model. That is why the same model can be reliable in one system and useless in another: the difference lies not in the model but in the loop, the tools and the error handling built around it.
How it connects to any given tool is nowadays covered by a standard too — but that is the next level up.
The number that explains everything
Here is the part most agent demos leave out.
Suppose an agent executes each individual step with 98% reliability. That sounds like a very good rate.
- A 5-step task: 90% chance of success.
- A 20-step task: 67%.
- A 50-step task: 36%.
Real business processes typically land between 20 and 50 steps. That is why you see spectacular demos and disappointing rollouts of the same technology: the demo is five steps, production is forty.
From which follows the most important design rule: do not think in terms of one long autonomous run, but of several short, checked stages. Five stages of five steps each, with a checkpoint at the end of every one, is far more reliable than a twenty-five-step free run.
Where should a human sit in the process?
Not everywhere — that would defeat the purpose. Three places are worth it:
- Where money moves. A transfer, an order, sending out a quote.
- Where something goes outside. An email to a customer, published content.
- Where it is irreversible. Deletion, overwriting, closing a contract.
Every other step can run without approval. If it asks at every point, the human becomes the bottleneck and the project defeats its own purpose.
The permissions people get wrong
The most common and most expensive mistake: the agent gets more access than its job requires — usually because that was the simpler thing to configure.
The ground rule: read access by default, write access per tool, granted separately. An agent whose job is to write a report should not be able to delete a record. Not because it is malicious, but because a misread instruction or a manipulated input is enough for it to do damage.
This is the biggest real risk with agents today — not that one "becomes self-aware", but that you handed it too many keys.
What it is good for today, and what it is not
Good for: a process with many steps but clear boundaries, where the result can be checked. Gathering data from several sources, working through a set of documents, assembling a recurring report, writing code with tests that tell you whether it works.
Not good for: a task with no verifiable end result; one where an error is expensive and does not surface immediately; and one that a simple, pre-written automation would also solve. That last case is more common than you would think — if the sequence of steps is always the same, you do not need an agent, you need a workflow. It is cheaper, faster and predictable. Can AI Do This Task? gives you a quick way to tell the cases apart.
What to take away
An agent is worth it when the task contains a decision — if it does not, plain automation is better. And when you roll one out, everything hinges on two things: short, checked stages, and the fewest permissions possible. Those two are what separate a working system from an impressive demo.