The interesting thing about AI agents is not that they talk better, but that they finish work. A team deploys an assistant to keep the shared inbox tidy. It reads incoming messages, files them, drafts a reply and leaves it queued. It works well and saves an hour a day.
After a month the last step is removed: it can send too, because the drafts were always fine anyway.
That is the moment an assistant becomes an agent. It saves even more time, and it calls for one new decision: what is it allowed to do on its own?
What is the difference between answering and acting?
A chatbot does one thing: it turns text into text. What happens to that text is your decision. You copy it, you edit it, you throw it away.
An agent receives a goal rather than a question. "Keep this inbox under control." It then determines the steps required and executes them using tools it has been granted.
Those tools are the crux. Without them, an agent is a chatbot thinking out loud. With them, it can:
- read, draft and send email
- open, modify and delete files
- create and move calendar entries
- update records in a system
- search the web and open pages
- execute code
Every integration makes it more useful, and each one is also one more thing that can go wrong.
What are agents good at?
Agents are at their best with multi-step, predictable work that currently shuttles between systems: sorting messages and queueing a first reply, moving details from incoming forms into a system, gathering information from several sources for a briefing, or finding a slot across busy calendars. Work you could do perfectly well yourself, but which mostly eats time.
They are less suited to work where the judgement is the work: a sensitive customer conversation, a decision about an employee, a trade-off that depends on context nobody wrote down. There, an agent is more useful preparing the work than doing it.
What changes when the human steps out?
With a chatbot, a person sits between decision and action. That person is imperfect and skims most of it, but they catch the gross errors: wrong client, wrong amount, wrong recipient.
With an agent, that step is gone. A misunderstanding stops being a wrong answer and becomes an action already taken.
Two things make this sharper than it first looks.
An agent takes multiple steps. If step two rests on a wrong assumption, steps three to seven build on it. What arrives at the end is internally consistent and wrong from the beginning.
An agent reads untrusted sources. The most underrated part. An agent processing your mail reads messages written by strangers, and it may follow instructions hidden in them. Security researchers call the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content and the ability to communicate externally. An agent with all three is exploitable, and most useful agents have all three. See what prompt injection is.
This is not hypothetical. In June 2025 researchers disclosed EchoLeak, a vulnerability in Microsoft 365 Copilot in which a single email, never opened by the recipient, was enough to have internal data sent out. Microsoft fixed it. The pattern did not go away with the patch.
How do you decide what an agent may do on its own?
With a chatbot the core question is: what can it see? An authorisation question about reading.
With an agent, a second question comes up: what can it do? An authorisation question about writing, and a weightier one, because reading is reversible and acting often is not.
A workable way to classify each action:
- Reversible and visible. Drafting a reply, creating a folder, applying a label. Fine to run unattended.
- Reversible but invisible. Updating a record, editing a file. Fine unattended, provided it is logged and can be rolled back.
- Irreversible. Sending, deleting, publishing, paying, granting access. A human confirms here, and that is not distrust, it is design.
That third category is exactly where the example above went wrong: not in the quality of the drafts, but in removing the button.
How do you start?
- Which tools does it get, and does the task need all of them? Start narrow and widen.
- Whose permissions does it act with? Its own restricted account beats the user's, because then its reach is explicit.
- Which actions are irreversible, and do they require confirmation?
- Is what it did recorded, and can someone review it?
- Does it read external content? If so, it should not also have access to confidential data and the ability to send things out.
What stands out about those five: none of them mentions AI. They are the questions you would ask of any automated process holding permissions, which makes them manageable. Pick one task, let the agent handle only reversible steps on its own at first, and after a few weeks read through the log to see what it did. If that holds up, widen its reach step by step. You get the time back, and sending stays a deliberate choice.
