'Agentic AI' is the phrase of the year, and it's doing a lot of work covering for systems that range from genuinely useful to quietly reckless. Here's a grounded look at where letting AI take actions makes sense — and where it doesn't yet.
- An agent is just an LLM that can call tools in a loop. The power and the danger both come from the same thing — it takes actions, not just words.
- Scope autonomy to the blast radius. Reading and drafting can be liberal; anything irreversible or costly needs approval or hard guardrails.
- The reliable pattern today is narrow agents on well-defined jobs with a human on the risky steps — not one autonomous system running your business.
"Agentic AI" is the phrase everyone's using this year, and like most phrases that get that popular, it's stopped meaning anything precise. It's stretched to cover everything from a genuinely useful tool that drafts and files a report, to demos that quietly hand a language model the ability to send emails, move money, or change production data with nobody watching. Those are not the same thing, and the gap between them is exactly what a business needs to understand before it "adopts agents."
So let me try to say something concrete and unfashionably grounded about what agents actually are, where they help, and how to use them without getting hurt.
An agent is a model that can act
Strip away the mystique and an agent is a simple idea. A normal LLM call takes text in and gives text out. An agent wraps the model in a loop and gives it tools — functions it can choose to call — so it can take actions and use the results to decide what to do next.
goal ─▶ ┌────────────────────────────────────┐
│ model decides: answer, or use a │
┌─▶│ tool? ─▶ call tool ─▶ read result │──┐
│ └────────────────────────────────────┘ │
└──────────────── loop until done ◀─────────┘Give it a tool that searches your docs, one that queries a database, one that sends an email, and the model can now string them together toward a goal: look something up, decide what to do, do it, check the result, continue. That's genuinely powerful. It's also where the caution comes from — because the whole point is that it acts, and it decides those actions probabilistically.
The moment you give an AI a tool, you've changed the question. It's no longer "will the answer be good?" It's "am I comfortable with what happens when it's wrong and it has already acted?"
The autonomy dial, and why the tools decide everything
The single most important design decision in an agent isn't the model or the prompt. It's what the tools let it do — because that defines the blast radius when it makes a mistake, and it will make mistakes.
I think about tools in tiers:
- Read-only. Search, look up, fetch, summarise. A wrong action here wastes a little time and money. Autonomy can be generous.
- Reversible writes. Draft a document, create a ticket, add a note. A mistake is annoying but easily undone. Some autonomy, with visibility.
- Irreversible or costly. Send an email to a customer, charge a card, delete records, change production config. A mistake here is real and public. This tier needs a human approval step or hard-coded guardrails — often both.
The failure I see coming — and occasionally get called in to clean up — is teams thrilled by a read-only agent's competence, who then hand the same architecture a send_payment tool and trust it the same way. Reliability at reading something tells you nothing about the wisdom of letting it act unsupervised.
Where agents genuinely help right now
Grounded in that framing, there's real value available today — mostly in narrow, well-defined jobs rather than sweeping autonomy.
- Research and gather. An agent that searches multiple sources, pulls the relevant pieces together, and drafts a summary a human reviews. Read-heavy, low-risk, real time saved.
- Triage and route. Reading incoming work, classifying it, enriching it with a lookup, and proposing where it goes — with the consequential decisions still confirmed by a person.
- Multi-step retrieval. Answering a question that needs several lookups chained together, where a single retrieval wouldn't reach the answer.
- Draft-and-file workflows. Preparing something — a report, a response, an entry — and staging it for approval rather than committing it.
The pattern under all of these is the same one that keeps winning across applied AI: the agent does the legwork, a human owns the consequential decision. Narrow scope, clear job, human on the risky steps.
Where they don't fit yet
Equally honestly, some things being pitched as agentic are ahead of what's reliable.
One agent running a whole complex process end-to-end, unsupervised. The longer the chain of autonomous steps, the more places a small error compounds into a confidently wrong outcome — and the harder it is to see where it went off track. Long, unsupervised chains are fragile in ways short ones aren't.
Anything where a wrong action is expensive and irreversible, with no human gate. This is the read-only-competence trap again. The bar for unsupervised irreversible action is very high, and most business processes don't clear it today.
Situations that demand accountability. When someone has to answer for a decision — a customer outcome, a financial call, a compliance step — "the agent did it" is not an acceptable answer. A human needs to own it, which means a human needs to be in the loop.
How to adopt agents without regret
If you want to use agents — and for the right jobs you should — the sane path is incremental:
- 01Start read-only. Let an agent gather, search, and draft before it ever writes anything. Build trust where mistakes are cheap.
- 02Add reversible actions next, with everything it does visible and undoable.
- 03Gate the irreversible. Human approval or tight, hard-coded constraints on anything that costs money, touches customers, or can't be taken back.
- 04Log every action and decision. When an agent does something surprising — and it will — you need to reconstruct exactly what it did and why. An unobservable agent is one you can't operate.
- 05Measure it like any AI feature. Evaluate whether it actually completes its job correctly, and keep watching after launch.
The grounded version
Agents are a real and useful development, not a gimmick. An LLM that can take actions genuinely opens up work that pure question-answering couldn't touch. But the useful reality is quieter than the marketing: narrow agents doing well-defined jobs, generous autonomy where mistakes are cheap, a firm human hand where they aren't.
The businesses that get value from agents this year won't be the ones that handed an AI the keys and hoped. They'll be the ones that were honest about the blast radius of every action — and built the human back into the loop exactly where it needed to be.