An AI agent is software that uses a model to interpret a goal, choose actions and use tools or data to make progress. Autonomy exists on a spectrum. A system can still be an agent when a person must approve important steps.
That definition is more useful than arguing whether every vendor has earned the label.
Chat, workflow and agent are different patterns
Chat assistant
A chat assistant receives a prompt and returns content. It might search or summarise, but the user remains the main operator.
Deterministic workflow
A workflow follows steps chosen in advance: when X happens, perform Y, then Z. It may call an AI model inside a step without becoming agentic.
Agent
An agent can decide which knowledge or tool to use and how to sequence work. Microsoft describes five core components: a generative model, instructions, retrieval, actions and memory (Microsoft Cloud Adoption Framework).
The four-part agent test
Ask these questions about a product:
- Goal: does it receive an outcome rather than only a single command?
- Choice: can it choose among tools or next steps?
- Action: can it change something outside the conversation?
- State: can it retain relevant context across steps?
The more of these a system has, the more agent-like it is. The same progression also increases the need for control.
Why tool access changes the risk
A poor chat response may waste time. A poor agent decision can send an email, expose a record or change a production system.
Before connecting a tool, define:
- the identity used by the agent
- the minimum permissions it needs
- allowed actions and forbidden actions
- spending and rate limits
- data available to the model
- human approval points
- audit logs and alerting
- a stop switch and recovery process
Microsoft's guidance for autonomous agentic systems stresses least privilege, deterministic safeguards, human involvement, observability and approval for high-risk actions (Microsoft Security).
MCP is a connection method, not proof of agency
Model Context Protocol, or MCP, is a way for an AI application to discover and call tools or retrieve context through a common interface. An MCP connection can give a model useful capabilities. It does not by itself provide safe permissions, reliable planning or accountable autonomy.
Judge the whole system, including the host, model, server, credentials, data, approval path and logs.
A safe first agent
Start with a reversible, low-impact task:
- read from an approved source
- create a draft in a review queue
- show the evidence used
- require a person to approve publication
- record the request, proposed action and decision
Do not start by allowing unsupervised deletion, payment, external communication or permission changes.
The proof boundary
Calling software an agent says nothing about its accuracy, autonomy level or security. Those properties must be tested against a defined task and failure model. Even a well-controlled agent can produce a wrong result, so consequential work still needs verification and ownership.
If you are trying to turn an agent demo into a governed workplace service, join Microsoft Copilot Adopters.