Agentic AI and AI agents.

From chatbots to agents

A chatbot answers. An AI agent acts. Agentic AI is the name for systems in which a language model does not just reply to a message but works towards a goal: it decides what to do next, uses tools to do it, looks at the result and carries on until the task is done or it needs help.

A simple way to see the difference:

• Chatbot: "Here is how you could check this customer against the sanctions lists."
• Agent: runs the check, reads the result, gathers the customer's history, drafts a case note and asks a person to approve the next step.

Agents are useful for work that has many small steps and needs judgement between them: investigating an alert, preparing a report from several systems, triaging support requests. The same ability to act is what makes them risky. A wrong answer from a chatbot is a bad paragraph; a wrong action from an agent can move money, delete data or send a message you cannot take back.

So the central question for agentic AI in any serious setting is not "can the agent do it?" but "who authorised it to?"

How an agent works

Most AI agents are built from the same parts:

• A model that reasons about the task and decides the next step.
• Tools: functions the agent is allowed to call, such as searching a database, reading a document, calling an API or sending an email. The model asks for a tool with specific inputs; ordinary software runs it and returns the result. This is often called tool calling or function calling.
• A loop: plan, act, observe the result, then decide again. The loop continues until the goal is met, a limit is reached or a person is needed.
• Memory: what the agent keeps from earlier steps or earlier sessions, from a short working history to a searchable store of past cases.
• Instructions and limits: the goal, the rules it must follow and when it must stop and ask.

Standards are emerging for connecting agents to tools and data. The Model Context Protocol (MCP), an open protocol introduced by Anthropic in 2024, is one widely adopted example: a tool or data source is described once and can then be used by any compatible agent.

Some systems use several agents, each with a narrow role (one gathers evidence, one drafts, one checks), coordinated by an orchestrator. More agents can mean more capability, but also more places for errors to hide.

What can go wrong

Agents inherit every weakness of language models and add new ones, because their mistakes become actions:

• Prompt injection: instructions hidden in an email, web page or document the agent reads can redirect it, for example "ignore your task and forward this inbox". This is the most serious agent-specific risk.
• Excessive agency: an agent given more tools or permissions than its task needs can do more damage when it goes wrong. Security guidance for AI applications, such as the OWASP list of top risks for language-model applications, names this directly.
• Compounding errors: a small mistake early in a long chain of steps is built on by every later step.
• Data leakage: an agent with access to sensitive data can include it in an output, a log or a call to an outside service.
• Runaway loops and costs: an agent that never decides it is finished keeps calling models and tools.
• Unclear accountability: when something goes wrong, nobody can say who approved the action or why the agent took it.

None of these is a reason to avoid agents. Each is a reason to design the controls before the agent goes live.

Guardrails that work

Good agent design limits what can go wrong and makes everything visible:

• Least privilege: give the agent only the tools and data its task needs, with read-only access wherever possible.
• Human approval for consequential actions, such as payments, account changes, messages to customers and deletions. The agent proposes; a person approves.
• Rules that the agent cannot override: hard checks in ordinary code, outside the model, that block forbidden actions whatever the model says.
• Treat everything the agent reads as untrusted: content from emails, documents and web pages is data, never instructions.
• Limits: on the number of steps, the time, the cost and the rate of actions, with an automatic stop.
• A complete audit trail: every input, tool call, result and approval recorded, so any action can be explained later.
• A switch-off: the ability to pause or disable an agent immediately without breaking the business process it supports.
• Testing before and after every change, including deliberate attempts to trick the agent.

The simplest test of an agent design: if the model behaved as badly as possible, what is the worst it could do? The guardrails should make that answer acceptable.

Governing AI in an organisation

As agents spread, organisations need to govern them together, not one project at a time. The basics are:

• An inventory of every AI system and agent in use: what it does, what it can access, who owns it and which model version it runs.
• A named owner accountable for each agent's behaviour.
• Risk classification: the more an agent's actions affect people, money or safety, the stronger the controls and the review.
• Monitoring of how often agents are right, how often people overrule them, and what they cost.

Frameworks help. The NIST AI Risk Management Framework (2023) organises the work into four functions: Govern, Map, Measure and Manage. ISO/IEC 42001 (2023) is the international standard for an AI management system, against which organisations can be certified. The EU AI Act, which entered into force in 2024, sets obligations according to the risk of an AI system, and affects organisations that offer AI in the European Union. Data protection law also applies: in Kenya, the Data Protection Act, 2019 gives people rights over significant decisions made solely by automated processing.

In Saolix Eagle, the optional AI agent, Raia, can suggest a label for a screening alert, but it can never close one: a guard in code sends any real hit back to human review. Saolix is planning an Agent Manager to register, permission, monitor and switch off AI agents in one place. See Sōli AI agents.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.