A chatbot produces text. You read it and decide what to do. An AI agent is a system where a model chooses and carries out a series of actions, using tools, to reach a goal. A tool is something the agent is allowed to use: read a calendar, search a site, book a room, send an email, run code. The agent uses a tool, looks at what came back, and decides what to do next.
Most agents work in a loop: Goal → Plan → Act → Observe → Decide, then back to Act, until the goal is met or something stops it. The "Observe" step matters. When what the agent sees isn't what it expected, it has to change its plan.
An invented agent, in an invented school. Step through it, then flip the room to taken and watch the plan change.
| Kind | Who picks the next step? | Example (invented) |
|---|---|---|
| Chatbot | You. It only writes text. | You ask for three team names and it lists them. |
| Fixed automation | A script. The same steps every time. | Every Friday at 3 a.m., copy a file to a backup folder. |
| Agent | The model, one step at a time. | "Find a free room Thursday and book it." It looks, picks, books, and adjusts. |
A fixed automation is predictable and can't adapt. An agent can adapt, and that is also why it can surprise you. The word "agent" is used loosely in advertising. To check, ask two questions: who chooses the next step? and what can it do without asking me?
Least privilege means giving an agent only the access it needs, for only as long as it needs it. If it has to read one folder, don't give it the whole drive. If it only has to draft, don't let it send. Nothing has to be wrong with the model for this to matter. A smaller reach means a smaller mistake.
Not every action carries the same risk. A useful question is: if this goes wrong, can a person take it back?
| Rung | Example | A reasonable starting setting |
|---|---|---|
| Read | Look at a calendar | Auto, if the data is okay for it to see |
| Draft | Write an email, don't send it | Auto. A person still uses it |
| Change (can undo) | Book a room that can be cancelled | Auto with a log, or Ask first while you learn to trust it |
| Hard to undo | Send, delete, buy, post publicly | Ask first, or Off |
Sort each action. Ask: if this goes wrong, can a person undo it?
Sort all eight to see how you did.
"Ask first" means the agent stops and shows you what it wants to do. You approve or say no. That puts a person's judgment in the loop at the point where it matters most. But it only works if the person really reads. If an agent asks for approval ten times an hour, people start clicking yes without reading. That is called approval fatigue. So ask only where it matters, and make the request clear: what it will do, to whom, and whether it can be undone.
A log is a record of what the agent actually did: the action, the tool, what it sent, what it saw, when, and who approved. A good log lets someone else find the first step that went wrong, decide whether it can be undone, and fix the setup so it doesn't happen again.
| A log | The agent's own explanation | |
|---|---|---|
| What it is | A record of actions, written as they happen | Text the model writes when asked "why did you do that?" |
| Can you check it? | Yes, against what really happened | Not easily. It can sound sure and be a guess |
| Use it to | Find the first wrong step and undo it | Get a lead. Then check it against the log |
Suppose each step is right 95% of the time. For two steps the chance both are right is 95% × 95%. For ten steps it is 95% multiplied ten times. Move the sliders and watch.
These numbers are made up to show the math. They are not measurements of any real agent.
Chance every step is right: 95% × … (10 times) = 60%. At 95% per step, the chance of a clean run drops below half after 14 steps.
A guardrail is a protective measure around an agent. Each kind catches some problems and misses others, so you stack them:
| Layer | Example | How it can fail |
|---|---|---|
| Input filter | Strip instructions out of documents the agent reads | A new wording gets past it |
| Permissions | "Send" is Off, or the agent sees one folder | Too broad, or never reviewed |
| Approval gate | "Ask first" before anything hard to undo | A rushed person clicks yes |
| Output limit | Email only addresses on a list; spend no more than $20 | The limit is set too loose |
| Step or time limit | Stop after 10 actions | It stops after the harm |
| Log and stop switch | Record everything; a person can halt it | Doesn't prevent anything. Helps you find and fix |
Telling the model to "be careful" is not on this list. A request in a prompt can be ignored or overridden. A guardrail has to work even when the model gets it wrong.
Here is an invented agent with a job, a built-in typo in its email, and a hidden instruction in the sign-up sheet. Set its permissions and guardrails. Find a setup where the job gets done correctly, nothing leaks, you approve no more than twice, and there is a log. Then try breaking your own setup.
A fixed script plays an invented "Club Helper." Task: book a room for the robotics club and email the members. Everything here is invented. Change a setting and the run below updates.
Things to try: switch the hidden instruction to wording B with the input filter on. Then uncheck "I read every request carefully." Which layer stopped it each time?
An invented helper was asked: “Order 12 notebooks for the club, $1 each.” Here is its log.
1. Read the club budget: $200 available. 2. Search the school supply site: notebooks, $1 each. 3. Place order: 120 notebooks, $120. 4. Pay with the club card.