An AI agent is not a smarter chatbot: it is a system that receives a task, uses tools, follows rules and leaves a person in control of the actions that matter. This article explains the difference between assistant, automation and agent, and the four elements (task, tools, rules, control) to check before entrusting a process to an agent.
In the last two years the word “agent” has landed on every product that contains a language model. A chatbot for the website is an agent. A plugin that summarises emails is an agent. An automation flow with one AI step is an agent. The result is that anyone who has to decide on an investment faces very different offerings described with the same words. According to Gartner, in 2025 only about 130 of the thousands of vendors calling themselves “agentic” really were; the rest was, in the analyst’s words, “agent washing”: existing products rebranded without substantial agentic capabilities.
This article is meant to bring some order. First an operational definition, then the difference between three things the market confuses, and finally the four elements that separate a reliable agent from one that will remain a demo.
An operational definition
An AI agent is a software system that receives a task (not a question), decides which actions to take to complete it using tools (systems, data, channels), and does so within rules that establish what it can do on its own and what it must have approved by a person.
Three words in this definition weigh more than the others.
- Task. You ask a chatbot a question and you get an answer. You entrust an agent with a job: “read this mailbox, recognise enrolment requests, open the case in the management system and prepare the reply”. The task has a beginning, an end and a verifiable result.
- Actions. The agent does not just produce text: it writes into the CRM (Customer Relationship Management), fills in a document, sends a reminder, updates the status of a case. That is why “what can it do” matters more than “what can it say”.
- Rules. An agent without explicit rules is an operational risk, not an automation. The rules say which actions require approval, which data cannot leave the company, what to do when the model is not sure.
Assistant, automation, agent: three different things
The confusion arises because the three categories use the same underlying technology, language models, but put it in different positions in the process.
| Assistant | Automation | Agent | |
|---|---|---|---|
| Who starts the work | A person, every time | An event (an email, a schedule) | An event or an assigned task |
| What it produces | An answer or a draft | A predefined action | A sequence of actions decided case by case |
| Who decides the next step | The person | Nobody: the flow is fixed | The agent, within the rules |
| What happens in unforeseen cases | The person notices | The flow stalls or errs | The agent asks a person |
| Example | “Summarise this email” | “When an email arrives with a PDF attachment, save it to a folder” | “Handle the enrolment requests arriving in the mailbox” |
The assistant amplifies a person: useful, but it does not remove work from the process, because someone still has to open the email, read it, decide and act. It is the model of individual subscriptions to generative AI tools.
Classic automation (rules, flows, RPA, Robotic Process Automation) removes work but only in the cases foreseen. It works well when the input is structured and always the same; it breaks when an email arrives written differently, an attachment comes in the wrong format, a request contains two questions instead of one.
The agent sits in between: it removes work like automation, but handles the variability of the real world the way a person would, interpreting the input and choosing the action. The price of this flexibility is that it must be governed: without rules, control and measurement, the same capacity to “decide” becomes the source of errors.
Why the distinction matters to decision-makers
It is not a matter of vocabulary. The three categories have different costs, risks and returns, and a project often fails because one is bought in the belief of getting another.
Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, for three reasons: escalating costs, unclear business value, inadequate risk controls. All three stem from confusing the categories. Those who buy an assistant expecting an agent see no return, because the work stays with people. Those who build an agent without rules discover risk controls after the first incident. Those who have no baseline indicator cannot demonstrate value to anyone.
The same Gartner estimates that by 2029 agentic AI will autonomously resolve 80% of common customer service issues. The two predictions do not contradict each other: they say the technology works, but that most projects are set up wrongly.
In Italy the context is still moving: according to ISTAT, in 2025 16.4% of companies with at least 10 employees use AI, double the previous year, with a sharp gap between large companies (53.1%) and small ones. The competitive advantage, at this stage, belongs to those who start with the right project, not to those who start first.
The four elements of a reliable agent
When evaluating an agent platform, or an internal project, it is worth checking that each of these four elements is explicit, documented and verifiable. If one is missing, it is not an agent ready for production.
1. Task: a defined perimeter and an indicator
A reliable agent has a precise task, not a generic one. “Handle the mail” is not a task; “classify the emails in the enrolments mailbox, extract the learner’s data and open the case, with a confidence level” is. The perimeter can be described on one page, with real examples of input and expected result.
A baseline indicator is attached to the task: the average time per case, the share of requests waiting more than a day, the number of transcription errors per month. Without a number measured beforehand, nobody will be able to say whether the agent worked.
Questions to ask: what is the task, in one sentence? What are ten real examples? Which indicator do we want to move, and what is it worth today?
2. Tools: access to systems, with the right permissions
An agent acts through tools: reading the mailbox, writing into the CRM, generating a document, sending a message. Every tool is an integration, and every integration has two properties to check.
The first is the method: the system’s official APIs are the most solid route; user-interface automation (simulating a user’s clicks) is fragile and should be used only when there is no alternative.
The second is permissions: the agent must operate with its own identity and with the minimum privilege needed. An agent that reads mail does not need to delete it; an agent that opens cases does not need to edit the customer master data. If the platform cannot distinguish, permissions will always be too broad.
Questions to ask: which systems must the agent talk to? Through APIs or through the interface? With which account and which permissions?
3. Rules: what it can do alone and what it cannot
This is the most neglected element and the most important. The rules establish, action by action, the level of autonomy: execute (the agent acts and records), prepare (the agent proposes and a person approves), suggest (the agent flags and nothing more).
The safest model to start with is “prepare and validate” on everything: every action is born as a proposal and a person confirms it. It costs time at the beginning, but it produces two precious things: trust from the people who see what the agent does, and data on how often the proposals are correct. When, for a given action, proposals are approved unchanged in 98% of cases for weeks, raising autonomy on that action is a decision based on numbers, not on hope.
The rules also include confidence thresholds (below a certain certainty, the agent does not decide) and data constraints (which information cannot go out to external models, the subject of the article on pseudonymisation).
Questions to ask: for each action, what is the initial level of autonomy? How and when is it raised? What happens below the confidence threshold?
4. Control: traceability and the ability to intervene
The last element is the ability to reconstruct and correct. A reliable agent leaves an audit log of every operation: who or what did it, when, on which data, with which version of the instructions, with which model. The log must be tamper-evident, because it is needed precisely in the cases where something went wrong.
To the log are added versioned instructions: the agent’s behaviour is described in a text that can be read, edited and compared with the previous version, without touching the code. And evaluations: a set of real cases on which every change is tried before going into production, like tests for traditional software.
Questions to ask: can I see, for any case, everything the agent did and why? Can I change the instructions without a software release? How do I verify that a change does not worsen the results?
A checklist for the first meeting with a vendor
The four questions below are enough, in most cases, to understand in a few minutes whether you are talking about an agent or a rebranded assistant.
- “Show me a complete task, from the event to the result in our systems.” If the demo ends with generated text, it is an assistant.
- “How do you decide what the agent does alone and what it has approved?” If the answer is “it’s configurable” without showing where and how, the rules do not exist yet.
- “Where do I see what the agent did yesterday, and with which data?” If there is no log to consult, there is no control.
- “What happens to our data when the agent calls an external model?” If the answer is vague, the risk is entirely yours.
In conclusion
An AI agent is not a better chatbot. It is a system that takes on a task, acts on business systems and does so within explicit rules, with a person remaining in charge of the decisions that matter. The four elements (task, tools, rules, control) are not technical details: they are the difference between a project that reaches production and one that stops at the demo. Before choosing a technology, it is worth writing down on one page the task, the baseline indicator and the autonomy rules. It is the most tedious work of the project, and it is the work that decides its outcome.