What is an AI agent?

An AI agent is an AI that can take actions for you, such as looking something up or sending an email, and decide for itself which step to take next, rather than only writing text. For most small businesses, the first things worth automating don't need an agent at all.

The word gets attached to almost everything now, and even the two biggest AI companies define it differently. Anthropic's engineering team opens its own guidance by admitting as much: "'Agent' can be defined in several ways." That's worth knowing before anyone quotes you for one.

What an AI agent actually is

Think of the difference between a new starter following a checklist and an experienced assistant you give a goal to. The checklist tells the new starter exactly what to do, in order. The assistant works out the steps as they go. An agent is the second kind.

Anthropic's engineering post puts it in one line. Agents "are typically just LLMs using tools based on environmental feedback in a loop." An LLM, or large language model, is the AI behind products like Claude and ChatGPT. The rest of that sentence has three parts.

Tools are the specific things the AI is allowed to do: look up a customer, send an email, raise an invoice. They're ordinary pieces of software, not anything magic. Anthropic's developer documentation is clear about who does what: "You specify what operations are available and what shape their inputs and outputs take; Claude determines when and how to call them. The model never executes anything on its own."

The loop is four steps, repeated. Your software tells the AI which tools exist. The AI asks to use one. Your software runs it and reports back what happened. The AI reads the result and either asks for another tool or gives its answer.

The choosing is the only genuinely new part. The AI, rather than a person, picks what happens next.

What's the difference between an agent and an automation?

The difference is who decided the steps. Anthropic puts it like this: "Workflows are systems where LLMs and tools are orchestrated through predefined code paths. Agents, on the other hand, are systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks."

OpenAI is stricter. Its guide defines agents as "systems that independently accomplish tasks on your behalf", then rules things out: "Applications that integrate LLMs but don't use them to control workflow execution ... are not agents." The examples it gives are simple chatbots, single-turn LLMs and sentiment classifiers.

The two companies genuinely disagree here. OpenAI's definition excludes anything that follows a set path. Anthropic uses a wider label, "agentic systems", that covers both set workflows and agents. So a supplier could describe a fixed sequence of AI steps as agentic, be right under one company's definition and wrong under the other's. That's a big part of why the word has become so vague.

The useful question, whichever definition you prefer, is simple. Did a person decide every step in advance, or does the software work the steps out each time?

Why predictable is usually better for a small business

An automation you've specified does the same thing on Tuesday that it did on Monday. The steps are written down, so they can be read, tested and checked. When something goes wrong, it goes wrong in the same place each time, and it gets fixed once. In a routine business process, that predictability is most of the value.

Think about the jobs you'd hand over first. Raising the monthly invoices. Chasing the ones that are fourteen days overdue. Filing the signed job sheet into the right client folder. In each case you already know exactly what should happen. Adding initiative to that makes it riskier, not better.

If jobs like those are eating into your week, we're happy to set up a straightforward automation that handles them the same way every time.

The AI companies say the same in their own documentation. Anthropic: "When building applications with LLMs, we recommend finding the simplest solution possible, and only increasing complexity when needed." And on cost: "Agentic systems often trade latency and cost for better task performance, and you should consider when this tradeoff makes sense." Latency just means waiting time. OpenAI's guide says: "Before committing to building an agent, validate that your use case can meet these criteria clearly. Otherwise, a deterministic solution may suffice." A deterministic solution is one that does the same thing every time.

A lot of what gets called an agent is, underneath, a form, a rule and an email. That's often a genuinely good thing to have. It's just simpler than the word suggests, and easier to test and fix.

When is an AI agent worth it?

There's an honest case for agents, and it's an exciting one. Anthropic says they "can be used for open-ended problems where it's difficult or impossible to predict the required number of steps, and where you can't hardcode a fixed path."

OpenAI names three situations, which make a fair test to hold any proposal against. Complex decision-making: "workflows involving nuanced judgment, exceptions, or context-sensitive decisions". Difficult-to-maintain rules: "systems that have become unwieldy due to extensive and intricate rulesets, making updates costly or error-prone". Heavy reliance on unstructured data: "interpreting natural language, extracting meaning from documents, or interacting with users conversationally". Unstructured data means information that doesn't arrive in neat boxes, like emails and PDFs.

What these have in common is that the task genuinely changes from one time to the next. If it doesn't change, you need something that repeats rather than something that adapts. If you can write the rules on a page, a plain automation will do. Once that page turns into four pages of exceptions, or the input is a pile of supplier PDFs that all look different, an agent starts to make sense.

If you have a job like that and you're not sure which side of the line it falls on, we're happy to look at it with you and give you a straight answer.

What can go wrong when AI can take actions?

When AI only writes text, the worst outcome is a bad paragraph. When it can take actions, the worst outcome is a bad action, and some can't be undone. Anthropic's warning is about mistakes adding up: "The autonomous nature of agents means higher costs, and the potential for compounding errors." In a loop, a wrong turn at step two becomes the starting point for step three.

The Model Context Protocol, an open standard for connecting AI to software, is firm about this in its specification. "Tools represent arbitrary code execution and must be treated with appropriate caution." Users "must retain control over what data is shared and what actions are taken", the software running the AI "must obtain explicit user consent before invoking any tool", and descriptions of what a tool does "should be considered untrusted, unless obtained from a trusted server". On tools specifically: "For trust & safety and security, there SHOULD always be a human in the loop with the ability to deny tool invocations." In other words, a person should be able to say no.

The same standard's security guidance warns about giving too much access. Broad permissions create an "expanded blast radius", meaning more damage when something goes wrong, and "allow everything" settings such as *, all or full-access are listed as a common mistake. It recommends a "progressive, least-privilege scope model", which means giving only the access that's needed and adding more only when it's justified. It's the same principle as giving a contractor a key to the garage rather than the whole house. OpenAI suggests rating every tool an agent can use by "read-only vs. write access, reversibility, required account permissions, and financial impact", and keeping human sign-off for actions that are "sensitive, irreversible, or have high stakes".

For you, the question isn't how clever it is. It's what it can touch, whose login it uses, and what it can do that you can't reverse. Whose account it runs on matters for your data too, which we've written about separately in whether AI trains on your business data. Reading your inbox, sending emails as you, and moving money are three very different levels of risk. Anyone building one for you should be able to explain those limits plainly.

What to ask before you pay for an AI agent

Is this actually an agent? Does the AI choose the steps, or did a person write them in advance? If a person wrote them, it's an automation. Automations are good, but you should be paying for an automation.

Does it need to be one? What actually changes from one run to the next? If the honest answer is "not much", ask what the agent version gives you that a simpler automation wouldn't.

What happens when it gets something wrong? There should be a limit on how many times it retries, a route to a person, and a record you can read afterwards showing what it did.

We can't tell you what either should cost, because there are no reliable published figures to point you to. But for most businesses of two to ten people, the first two or three things worth automating aren't agents and don't need to be. Get the repeatable work running reliably first. If you'd like help choosing where to start, you can read about what we do, and we're happy to talk it through.

Sources

• Building effective agents - Anthropic engineering
• How tool use works and Tool use with Claude - Anthropic developer documentation
• A practical guide to building agents - OpenAI (PDF)
• Agents - OpenAI developer documentation
• Specification: security and trust & safety and Tools - Model Context Protocol
• Security best practices - Model Context Protocol

Checked on 17 September 2026, against MCP specification version 2026-07-28. Provider documentation on agents is rewritten often and the MCP specification is versioned by date, so follow the links rather than trusting the wording on this page. The definitions were current when checked.