The Rise of AI Agents
For most of the last decade, software that used a language model did one thing: it took text in and gave text back. A person read the answer and decided what to do with it. The shift now underway is smaller than the word “agent” suggests and more consequential than it sounds. The model can call a tool, read the result, and decide what to call next. The person is no longer between every step and its effect.
What actually changed
A chat assistant that is wrong produces a bad paragraph. An agent that is wrong produces a bad action — a record written, a message sent, a value updated. The difference is not the intelligence of the system. It is that the output now has a side effect, and side effects do not wait for someone to proofread them.
This is why the interesting engineering moved away from the prompt. Once a system can act, the questions that matter are the ones asked about any other actor with access to a production system: what is it allowed to touch, what happens when it is uncertain, and how would anyone reconstruct what it did.
Permissions decide the blast radius
An agent’s capability is the set of tools it can reach, not the model behind it. A very capable model with read-only access to two systems cannot cause a costly mistake. A modest model holding a credential that can move money can. The design choice that governs risk is made when the tool list is written, long before anything runs.
The useful default is fail-closed: an action the agent has not been explicitly granted is refused rather than attempted. That sounds obvious and is routinely inverted in practice, because broad access makes the demo work on the first try and the narrowing never happens afterwards.
Uncertainty has to have somewhere to go
A model asked to produce an answer will produce one. It has no native way to return nothing. So a system built on top of it needs an explicit path for the cases it cannot characterise — a threshold, a check against a rule, a queue where a person sees the item with the source attached and decides.
A review queue is often read as an admission that the automation is incomplete. It is the opposite. Without one, every uncertain case is silently resolved as if it were certain, and the failures arrive later, mixed in with the successes, indistinguishable until something downstream breaks.
The step that gets skipped
When a person does a task, they can be asked what they did. When an agent does it across several tool calls, the only account that exists is the one the system was built to keep: what it read, which version of the rule applied, what it wrote, when, and who approved the exceptions. If that is not recorded as the steps run, it does not exist, and the work cannot be defended to anyone who later disputes it.
This is the part that separates an agent that is interesting from an agent that is deployable in a place where money moves.
Where this leads
The rise of agents is not really a story about models getting better. It is a story about software being given the ability to act, and having to acquire the constraints that every other acting system already has. The teams that get value from agents are the ones treating them as a new kind of production component rather than a new kind of chat.
Related reading: what actually makes an AI agent trustworthy with money. Or see how we work.