Agentic AI: what the word hides

agentic ai is doing an enormous amount of marketing work this year, and almost none of it is about the thing that decides whether a build succeeds.

i run several of these in my own business — a fashion brand i founded in 2015, selling on marketplaces, where the boring operational work is real and the mistakes cost real money (some of them are written up here). not one of them was hard because of the model. every single one was hard for the same three reasons, and none of those reasons appears in a demo.

the word describes a property, not a product

agentic means the software picks its own next step instead of following one somebody wrote down. that is a genuine distinction and it is worth having a word for.

it is also not the distinction that decides a budget. the same build — a model that reads a request and calls the right function — is sold as agentic ai by half the market and as a chatbot by the other half, and the price differs by a factor nobody can justify from the code. when a vendor spends the meeting on how the model reasons, they are showing you the cheap quarter of the work.

the question underneath is permission. how far may it go before a person signs, what is it never allowed to decide alone, and what happens on the run where it stops. those three answers are written by a business before any code exists, and they are the whole project.

the hardest line in mine was written by somebody who does not code

when i built the robot that handles customer return requests, the specification arrived as a four-sentence note from the person who runs sales in my business. one of them was a prohibition, and it is the most important line in the whole system: never choose “approve without collecting the goods”. always either refuse, or approve and collect.

i would not have written that line. it is not an engineering decision — it is a decision about how much a returned garment is worth against the cost of a dispute, and the person who lives with that answer knows it in a way i do not. everything else about the robot follows from it: the default is approve-and-collect — the rule says roughly nine cases in ten — and a refusal needs a reason that fits one of two written rules — more than fourteen days between delivery and claim, or wording in the request that describes an obvious abuse.

that is what a never-do list looks like when it is real. it is short, it is specific to one business, and it comes from the person carrying the risk. a never-do list discovered after launch is not a specification. it is an incident report.

the limit lives in the permission, not in the prompt

there is a robot in the same business built around one job: taking products out of marketplace promotions before a promotion starts. today it only reads. it watches the promotion calendar on a schedule and hands one alert to a person, and it holds a read-only credential, so it could not write to the marketplace even if it decided to.

the write half is designed and not switched on. it exists as exactly one function — exclude — and there is no path anywhere in that module to add a product to a promotion. not because a prompt forbids it: because it was never written. the switch-on is still waiting on an access question i have not solved, and i would rather it wait there than ship a robot whose only limit is a sentence in a prompt.

that is the difference between a guarantee and a hope. a prompt saying do not add products to promotions is an instruction to a model that is right most of the time. a module with no add-path is a fact about the world. when somebody tells you their agent is safe because of how it is prompted, they have described a hope.

the same applies to what an agent can reach. it does not need access to everything to be useful, and every system it can write into is a system it can be wrong in. the useful build reaches exactly as far as its job.

every one of them started with a fortnight of proposing

not one of these went live acting on its own. the returns robot ran in the same shape first for a fortnight: it proposes, a person decides, and both answers get written down. a week or two of that settles arguments no demo can, because you stop discussing whether the thing is good and start reading the cases where you and it disagreed.

half of those disagreements are the robot being wrong in a way you can fix with a rule. the other half — and this is the part worth the fortnight — are the robot being right about something nobody had noticed. neither shows up in an accuracy number.

the chat robot that answers buyers went through this and could not have skipped it, because it is the outward face of the business. it is forbidden to promise a delivery date, a refund or money of any kind. a second pass reads every intended reply before a buyer sees it — and the part that actually holds the line is not the model. it is a plain deterministic filter, because the model-based checker leaked under variance and we watched it do it. that filter is not intelligence. it is a fence, and building it took longer than making the first pass write well.

when the answer is not an agent at all

a decision table is cheaper, faster, exactly repeatable and explicable to an auditor. if the job is a rule and nothing actually has to choose, the agentic version is a more expensive way to get a worse audit trail. i have talked more people out of these than into them, and the test is simple: say out loud what the thing decides. if the sentence describes a lookup, you want software, not an agent.

the other honest stopping point is measurement. if nobody can say what a correct outcome looks like, you cannot evaluate it, which means you cannot improve it and you will not know when it breaks. that is not a reason to wait for better models. it is a reason to spend a meeting agreeing the rule, which is usually worth more than the software would have been.

what should you ask a vendor about their own agent?

three questions, and they work on any vendor selling anything agentic:

how far does your product go before a person signs? what is it never allowed to decide? and what does it do on the run where it stops — who hears about it, and what do they see?

a vendor who can answer those three about their own product is describing a system. a vendor who moves the conversation back to the model is describing a demo with a better word attached to it. the word is not the problem. the word standing in for those three answers is.

related: what an ai agent build actually costs and when the robot refuses.

faq

what is agentic ai, in one sentence? software that picks its own next step instead of following one you wrote down. that is a real property and it is not the property that decides your budget — permission is.

how is an agent different from a chatbot? a chatbot answers. an agent acts: it books, updates, refunds, refuses. the difference is consequence, not intelligence, which is why the interesting engineering is the boundary rather than the model.

what does an agentic ai build actually cost? not the model. the expensive parts are data that disagrees with itself across your systems, the record of what it did and why, and the written list of things it must never decide alone. the model is a line item on a monthly bill.

how do i tell a real agentic system from a demo? ask three questions about the vendor’s own product: how far may it go before a person signs, what is it never allowed to decide, and what happens on the run where it stops. a vendor who cannot answer those about their own thing is showing you a demo with a better word attached.

should the agent be fully autonomous? usually one rung lower than planned. watching and telling you, or drafting for a person to sign, recovers most of the value at a fraction of the risk. acting inside a written limit is worth it once the audit trail exists.

who writes the list of things it must never do? the person who owns the risk, not the engineer. in my own business the hardest line in a returns robot was written by the person who runs sales, before any code existed, and it is a prohibition.

how are the limits actually enforced? in the code and in the credential, not in the prompt. one of mine runs on a read-only key and its write module contains exactly one function, exclude, with no path to add anything. that is a guarantee. asking a model to behave is a hope.

how long before an agent can act on its own? run it beside the person doing the job first — mine took a fortnight: it proposes, they decide, both answers get written down. the agreement rate is the number that matters, and reading the disagreements is where most of the learning is.

do multi-agent systems help? almost never at the start, and the question is usually a sign the first one has not been built yet. several models talking to each other multiplies the ways it can fail without multiplying what it can do.

if you want a second opinion on whether the thing you are being sold is an agent or a demo, the first conversation is an hour and it is free. book a time.

Created with AI assistance.