What is an AI agent? A working definition

An AI agent is a system that pursues a goal you give it by choosing its own steps, using tools to act on the world, observing what happened, and adjusting until the goal is met or it needs you. The distinction that matters: a chatbot produces text about your problem, an agent changes the state of your systems.

Four properties, and you need all of them

The word gets applied to almost anything with a model behind it. A definition worth using has to exclude things, so here are the four properties that separate an agent from a very capable text generator.

It decides its own steps. You state an outcome — “clean up my inbox” — not a procedure. If the sequence of actions is written in advance and the model only fills in text, that’s a workflow with a model in it.

It can act, not just answer. It calls tools that change something: sending, writing, updating, deleting. A system that can only produce text is a very good assistant, not an agent.

It observes results and adapts. A tool call returns something — a result, an empty set, an error. An agent reads that and revises its plan. Without this, you have a script that happens to be written by a model.

It knows when to stop and ask. This one is usually missing, and it’s the one that decides whether the thing is deployable in a business. An agent that cannot recognise “this next step is irreversible and I should check” is not autonomous, it’s unsupervised.

What it isn’t

Not a chatbot with plugins. Function calling is a capability an agent uses, not the thing itself. A model that calls one function you selected, in a turn you initiated, is answering — the loop is missing.

Not a workflow with a model inside it. If a human drew the trigger-and-action graph, the graph is doing the deciding. That’s automation with better text, which is genuinely useful and not the same category.

Not “autonomous” in the sense people fear. A well-built agent is bounded deliberately: scoped credentials, an approval gate on destructive steps, a logged trail. Autonomy is about who chooses the steps, not about whether anyone is watching.

The loop, concretely

Underneath, every agent is the same shape repeated:

1. Plan — decide the next step toward the goal.
2. Select a tool — find the capability that does it. At ten tools this is trivial; at a thousand it becomes the hard engineering problem, and we wrote about how we solved it.
3. Check the gate — is this step reversible? If not, stop and ask.
4. Act — call the tool with scoped, expiring credentials.
5. Observe — read what came back, including failures.
6. Repeat or finish.

Most of the engineering in a real agent is in steps 2, 3 and 5. Step 1 is where the model does its work, and it’s the part that gets all the attention.

Why the approval gate defines the category

Here’s the claim worth arguing with: an agent’s usefulness in a business is capped by how much you trust it, and trust comes from constraint rather than capability.

An agent that can delete things without asking is not more powerful than one that pauses — it’s less deployable, because nobody will give it access to anything that matters. The pause is what makes the access grantable in the first place.

This is why we treat approvals as architecture and not a setting. Reads run freely. Anything outbound or destructive stops for a human, with the exact action described before you approve it. That’s a design decision with real trade-offs, and it’s the difference between a demo and something you’d connect to a production inbox.

How to evaluate one

If you’re assessing a product that calls itself agentic, four questions cut through the marketing:

• Did I describe an outcome or a procedure? If you drew the steps, it’s a workflow.
• What happens when a tool call fails? If it stops or hallucinates a success, the observe step doesn’t exist.
• What can it do without asking me? If the answer is “everything” or “nothing”, neither is a real approval model.
• Can I see what it did? A run you can’t replay step by step is a run you can’t debug or audit.

Velaris is built on this definition — drive an agent in the live demo and watch it stop for approval before it touches anything irreversible.