Traditional software + LLM = an agent

The one-sentence definition

An agent is a loop: a model is asked what to do next, plain old code does it, the result is handed back, and the loop runs again until the job is done.

That is genuinely all. Everything else - "autonomous", "reasoning", "multi-agent orchestration" - is decoration on that loop. Let's take the cover off.

{
  "messages": [
    {"role":"system","content":"You are a travel helper..."},

Step through all six hops with X-ray on. Look at what is actually moving. It is JSON. It is an HTTP request. It is a function call with two arguments. There is no ghost in there.

The division of labour, and why it is exactly backwards from what people assume

Most people assume the model does the work and the code is plumbing. It is the other way round.

        THE MODEL                          THE CODE
┌─────────────────────────┐      ┌──────────────────────────────┐
│ decides WHAT to do       │      │ actually DOES it              │
│ reads messy human words  │      │ calls the flight API          │
│ picks a tool             │      │ enforces "never spend > €500" │
│ writes the final wording │      │ retries, logs, times out      │
│ NEVER touches the world  │      │ owns every real consequence   │
└─────────────────────────┘      └──────────────────────────────┘

The model is the part that is fuzzy and good with language. The code is the part that is exact and can be trusted with your credit card. Every well-built AI product keeps this line brutally clear.

A tool is not an AI thing. A tool is a normal function - the sort of thing programmers have written since forever - with a label attached that says what it is for:

Run it. Now change the description to something vague like "order thing" and imagine you are the model choosing between eight tools. Tool descriptions are prompts. Bad ones cause the model to pick the wrong tool, and everybody blames the model.

The loop, written out in plain words

1. Put the goal, the rules, the history and the tool list on the desk.
2. Ask the model: answer, or use a tool?
3. If it answered  → show the human. Done.
4. If it asked for a tool → CODE checks it is allowed, runs it,
   catches the error if it explodes.
5. Put the result on the desk.
6. Go back to 2.  (with a hard limit, or you will loop forever)

Step 4 is where all the engineering lives. "Check it is allowed" is not a footnote - it is the difference between a demo and a product. The model suggests; the code permits.

This is what fixes the problems from Level 2

Remember the risky column? Watch it dissolve:

This is why the phrase "hard-coded logic can be replaced by prompts and tools" is the whole thesis of modern AI engineering. The old way was: write 400 if statements to handle every phrasing of "where is my order". The new way is: write one reliable get_order_status function, describe it well, and let the model handle the infinite variety of human phrasing.

You did not delete the rules. You moved them to where they belong: inside tools, where they are exact, and out of the conversation, where they were always going to be brittle.

Levels of agent, from harmless to serious

1. Chatbot. Model + your words. No tools. Cannot be wrong about anything except facts.
2. Grounded chatbot. Someone silently pastes the right document on the desk before the model answers. This is what most "chat with your docs" products are.
3. Tool-using agent. It can look things up and calculate. Still read-only.
4. Acting agent. It can change things: send an email, refund an order, edit a file. The moment an agent can write, not just read, everything about safety changes.
5. Multi-step agent. It loops many times, plans, and calls sub-agents. Powerful, and the error rate compounds at every step - see the next level.

Be honest about which one you actually need. Most useful products in the world are level 2 or 3, and they are shipped and profitable while level 5 demos are still being debugged.

Where things stand (as of 2026)

Tool-using agents - level 2 and 3 on the ladder above - are now completely mainstream and boring in the good sense: search, calculators, code execution, and looking up your own documents are standard features, not novelties. Acting agents (level 4, things that can send, pay, or delete) are spreading fast but remain the riskiest category, and getting the permission boundaries right is still mostly unsolved as a general problem - every product does it slightly differently. Fully autonomous multi-step agents (level 5) still fail more often than their demos suggest, for the compounding-error reason the next lesson covers. Which specific products sit at which level, and how much autonomy they grant by default, changes constantly - check the date on anything you read comparing "agent capabilities" across tools.

How to read the docs and look things up

For agent products, look for the provider's own tool-use or function-calling documentation and, if available, their system card or safety documentation describing what the agent is permitted to do without asking. Changelogs and release notes matter more here than almost anywhere else, because permissions and defaults change between versions. A marketing page will say "autonomous" and show a slick video; real documentation will show you the actual list of tools, arguments, and what happens on failure. To test a claim in ten minutes: ask the agent to do something it would need a tool for, then ask it to explain exactly what it did and in what order - a well-documented agent can usually tell you, and a hand-wavy answer is itself informative. Note the date and the exact product version you tested, since agent behaviour is one of the fastest-moving parts of this field.

Check yourself

• In one sentence: what is the difference between a model and an agent?
• Who is responsible for refusing a €5,000 refund - the model or the code? Why is any other answer dangerous?
• Why is a tool's description as important as the tool's code?

Common mistake: asking "can the AI do X?" The better question is "what tool would a competent human need to do X, and can I hand the model that tool?" That question is answerable, buildable, and testable.

Recap: what changed in your head

• You know an agent is just a loop: model decides, code acts, result goes back on the desk.
• You know the model never touches the real world - code does, and code enforces the limits.
• You know a tool description is a prompt, and a vague one causes real failures.
• You know the risky things from Level 2 get fixed by handing the model the right tools.
• You can place any AI product on the five-rung ladder from chatbot to acting agent.