"Agent" now appears on almost every software sales page. Accounting tools, phone systems and CRMs all seem to have one. Some are real. Many are the same chatbot you saw a while ago, with a new label.

Here is a straight answer for owners and operators: what an AI agent is, what it isn't, and how to check before you sign anything.

A plain definition

An AI agent is a language model that can use tools and take several steps toward a goal, inside limits that someone set.

Each part matters. Tools means it can do things in your systems, not just talk: read an inbox, look up a price, create a draft invoice. Steps means it decides what to do next based on what it just found. Limits means there are rules about what it may touch and when it must stop and ask a person.

Take a quote request that arrives by email. A chatbot can write a polite reply. An agent reads the email, finds the customer in your CRM, checks current prices and stock, builds the quote in your quoting tool, and leaves it for someone to approve before it goes out.

OpenAI's practical guide to building agents draws the same line: applications that use a language model but don't let it control the workflow, such as simple chatbots, are not agents.

Agents, chatbots and automations

Chatbots answer

A chatbot holds a conversation about your hours, policies or products. It doesn't change anything in your systems, so its main risk is a wrong answer.

That risk is real. In a 2024 BC Civil Resolution Tribunal decision, Air Canada argued it wasn't liable for what its website chatbot told a customer about bereavement fares. The tribunal disagreed: the company is responsible for all the information on its website, whether it comes from a static page or a chatbot. If that holds for an AI that only talks, it holds at least as much for one that acts.

Automations follow a recipe

Tools like Zapier run fixed recipes: when a form is submitted, add a row to a spreadsheet and send an email. Same path every time, which makes them cheap, fast and easy to check. They break when the input doesn't fit the pattern: a supplier invoice in a new layout, or a customer email that asks two things at once.

Agents choose the next step

An agent can handle the messy input and pick its own path. Anthropic's engineering team describes the difference this way: workflows run models and tools through predefined code paths, while agents direct their own process and tool use. The same article warns that this freedom brings higher costs and errors that can compound from step to step.

So the honest advice: if you can draw the process as a flowchart with no "it depends" boxes, use a plain automation. Save agents for work where judgment is the bottleneck.

The parts of a working agent

  • The model. The language model that reads, reasons and writes. It matters, but it can usually be swapped for a newer one, and on its own it can't do anything in your business.
  • Tools. The connections that let it act: the shared inbox, the accounting system, the calendar. Without tools, you have a chatbot.
  • Knowledge and memory. What it knows about your business (price lists, policies, customer history) and what it tracks during a task. An agent working from last year's price list will send wrong quotes, quickly and politely. That's why the request we hear most at 2MDA is for a central "company brain": one place where company knowledge lives, kept current, and used by both staff and agents.
  • Guardrails. Which systems it can reach, whether it can write or only read, spending caps, how many attempts before it gives up. The OWASP security project lists excessive agency (too many functions, permissions or autonomy) as a core risk.
  • Human approval. A person signs off on anything costly, irreversible or customer-facing. OpenAI's guide recommends human oversight for actions like cancelling orders, authorizing large refunds or making payments, until the agent has proven itself.

What agents are good at today

  • Turning messy inputs into structured work. Sorting a support inbox by topic and urgency. Entering supplier invoices as drafts and flagging any that don't match the purchase order.
  • First drafts built on your data. Quotes, replies to common questions and job summaries that use your real prices and policies.
  • Lookups across systems that don't talk to each other. "Has this order shipped, and did they pay the last invoice?" means several logins for a person and one question for an agent.
  • Scheduling back-and-forth. Proposing and moving appointments while respecting your rules, such as travel time between job sites.

The common thread: plenty of volume, some judgment, and output a person can check in seconds.

Where they still fail

  • They can be confidently wrong. Models still produce answers that sound right and aren't, especially when the information they need is missing or stale. In an agent, a wrong answer becomes a wrong action.
  • Long chains go astray. The more steps a task takes, the more chances a small mistake has to carry forward and grow.
  • Unwritten rules are invisible. If the real policy lives in someone's head ("never book that client without a deposit"), the agent won't know it.
  • They can be manipulated. An agent that reads emails, attachments or web pages can be tricked by instructions hidden inside them. OWASP calls this indirect prompt injection. An agent that reads your inbox should not also be able to send a payment on its own.
  • Costs can surprise you. An agent may call the model many times for one task. Ask for the cost per task, not just a monthly licence fee.

How to tell a real agent from a rebranded chatbot

Gartner has a name for the problem: "agent washing," the rebranding of existing chatbots, assistants and robotic process automation as agents without the capabilities to match. In a June 2025 forecast, it estimated that only about 130 of the thousands of agentic AI vendors are real, and that over 40% of agentic AI projects will be cancelled by the end of 2027 because of rising costs, unclear value or weak risk controls.

When a vendor pitches you, ask:

  1. Can you show it working in a real system, live, on our example? Bring something messy: an odd invoice or a vague customer email.
  2. Which of our systems does it connect to, and with what permissions? A good answer is specific: read-only here, drafts only there. "It integrates with everything" is not an answer.
  3. What does it do when it isn't sure? You want it to stop and ask, not guess.
  4. Where does its knowledge of our business come from, and who keeps it current?
  5. Can we see a log of every step it took, and why?
  6. Which actions need human approval, and can we change that list?
  7. Where is our data stored and processed? The generative AI principles from Canada's privacy commissioners are clear that your business stays accountable for decisions made with AI.

Vague answers usually mean a chatbot with a new label. That's fine if a chatbot is what you need. Just don't pay agent prices for it.

Takeaway

An agent is a model with tools, knowledge and limits, plus a person approving the decisions that matter. Start with one job that is frequent, tedious and easy to check, such as triaging the support inbox or drafting quotes. Get the knowledge it needs written down and up to date, keep a human on approvals, and widen its scope only after it has earned your trust.