A system is an agent to the extent that it, rather than its author, decides what happens next. That is the whole distinction. Everything else - tools, memory, planning - follows from it or is optional decoration.
| Who chooses the next step | Failure mode | |
|---|---|---|
| Chatbot | Nobody - it answers and stops | Answers the wrong question fluently |
| Workflow with a model in it | The author, at design time | Breaks on a case the author did not foresee |
| Agent | The model, at run time | Chooses a plausible wrong action, confidently |
This is a spectrum, not a category. A "workflow with one model-chosen branch" is slightly agentic. A loop that can call any of forty tools until it decides it is finished is very agentic. The useful question is never "is this an agent" but "how much control has been delegated, and what happens when that delegation goes wrong".
The loop is the mechanism
Delegated control expresses itself as a loop. The agent observes, decides, acts, observes the result of acting, and repeats until a stop condition holds.
- 01Input
- 02Context
- 03Reasoning
- 04Tool selection
- 05Action
- 06Observation
- 07Memory
- 08Next action
The stop condition deserves more attention than it usually gets. An agent without a good one either halts too early - declaring success it has not verified - or not at all, which in production means an expensive loop calling the same tool until a limit kills it.
What is not part of the definition
- Autonomy from humans. An agent that must ask before every irreversible action is still an agent; it is a well-designed one.
- Multi-agent architecture. One agent with good tools beats five agents talking to each other more often than the literature suggests.
- A specific model. Agency is a property of the surrounding system.
- Long-running execution. A single-turn system that chooses its own tool is more agentic than a ten-step scripted pipeline.
If the model chooses the action, the safety question moves from "is the output correct" to "what can this system do, and what can it not undo". That reframing is why tool design and permission scoping matter more in agent products than prompt quality does.