A team deploys an assistant to keep the shared inbox tidy. It reads incoming messages, files them, drafts a reply and leaves it queued. It works well and saves an hour a day.
After a month the last step is removed: it can send too, because the drafts were always fine anyway.
That is the moment an assistant becomes an agent, and it is a larger step than it looks.
Answering or acting
A chatbot does one thing: it turns text into text. What happens to that text is your decision. You copy it, you edit it, you throw it away.
An agent receives a goal rather than a question. "Keep this inbox under control." It then determines the steps required and executes them using tools it has been granted.
Those tools are the crux. Without them, an agent is a chatbot thinking out loud. With them, it can:
- read, draft and send email
- open, modify and delete files
- create and move calendar entries
- update records in a system
- search the web and open pages
- execute code
Every integration is one more thing it can do, and therefore one more thing that can go wrong.
What changes when the human steps out
With a chatbot, a person sits between decision and action. That person is imperfect and skims most of it, but they catch the gross errors: wrong client, wrong amount, wrong recipient.
With an agent, that step is gone. A misunderstanding stops being a wrong answer and becomes a performed action.
Two things sharpen this beyond the obvious.
An agent takes multiple steps. If step two rests on a wrong assumption, steps three through seven build on it. What arrives at the end is internally consistent and wrong from the beginning.
An agent reads sources it does not trust. The most underrated part. An agent processing your mail reads messages written by strangers. Instructions inside them can be followed. Security researchers call the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three is exploitable, and most useful agents have all three. See what is prompt injection.
Not hypothetical. In June 2025 EchoLeak was disclosed, a vulnerability in Microsoft 365 Copilot where a single email the recipient never opened was enough to have internal data sent out. Microsoft fixed it. The pattern did not go away with the patch.
The question you ask
With a chatbot the core question is: what can it see? An authorisation question about reading.
With an agent a second one arrives: what can it do? An authorisation question about writing, and a heavier one, because reading is reversible and acting frequently is not.
A workable classification per action:
- Reversible and visible. Drafting a reply, creating a folder, applying a label. Fine to run unattended.
- Reversible but invisible. Updating a record, editing a file. Fine unattended, provided it is logged and can be rolled back.
- Irreversible. Sending, deleting, publishing, paying, granting access. A human confirms here, and that is not distrust, it is design.
That third category is exactly where the example above went wrong: not in the quality of the drafts, but in removing the button.
Before you enable one
- Which tools does it get, and does the task need all of them? Start narrow and widen.
- Whose permissions does it act with? Its own constrained account beats the user's, because the reach becomes explicit.
- Which actions are irreversible, and is confirmation attached to them?
- Is what it did recorded, and can someone read that back?
- Does it read external content? If so, it should not simultaneously hold confidential access and the ability to send outward.
What stands out about those five: none of them mentions AI. They are the questions you would ask of any automated process holding permissions. That is the point. An agent is not a new category of risk. It is a familiar category of risk now driven by something that can misread a sentence.
