Most 'AI Agents' Aren't Agents

Most "AI agents" aren't agents.

And it's not just semantics. One diluted word is causing enterprises to over-govern the AI that's safe and under-govern the AI that isn't. Review queues fill up with static pipelines that a change-advisory board treats like autonomous systems, while systems that actually decide their own actions ship under the same label with the same lightweight sign-off. The word stopped meaning anything. The risk didn't.

There's been a running debate about what "agentic" really means. One camp says: if it isn't getting smarter with every use, it's not an agent. That's directionally right about the ceiling — a system that improves its own policy is the fullest expression of the idea. But the real problem is the floor. Before we argue about whether an agent must learn, we should agree on the minimum a system must do before the word applies at all.

Thirty years of definitions

"Agent" is not a new idea, and it did not arrive with GenAI. Computer science has a rigorous lineage on this word going back three decades — the same lineage we taught in graduate ML and data science courses before any of this was fashionable.

Russell & Norvig (1995). Artificial Intelligence: A Modern Approach, first edition. A rational agent perceives its environment and acts on it to maximize expected performance. Perception, action, and a performance measure — the triad every later definition builds on.

Wooldridge & Jennings (1995). "Intelligent Agents: Theory and Practice" gave the field its most-cited behavioral checklist — the "weak notion of agency": autonomy, reactivity, pro-activeness, and social ability. A system that only responds when invoked, never initiates, and holds no goals of its own fails this test on three of four counts.

Sutton & Barto (1998). Reinforcement Learning: An Introduction — the canonical formalization of the agent–environment interface: state, action, policy, reward. The agent observes, acts, gets feedback, and improves. (The underlying math is older — MDP theory goes back to Bellman in 1957 — but Sutton and Barto's textbook is where the field's shared vocabulary lives.)

Anthropic (2024). "Building Effective Agents" drew the modern line for industry in exactly the same place the academic lineage does: workflows are LLMs orchestrated through predefined code paths; agents direct their own process and tool usage. They group both under "agentic systems," which is fair — but the distinction that matters is who directs the control flow.

Two honest caveats before I lean on this lineage, because the pedants are right about both.

First, this is a lineage, not a settled consensus. The field never converged on one canonical definition of "agent" — it converged on a family of them that all orbit the same center: perceive, decide, act, with the system rather than its caller in the driver's seat.

Second, by the classical definition, even a thermostat qualifies as a simple reflex agent. Russell and Norvig say so themselves. So the ladder below is not a history claim — history would let far too much through. It's a stipulation for the LLM era: the bar I'm proposing we hold the word to now, so that governance can follow autonomy instead of following marketing.

The ladder

By that lineage, most of what ships today doesn't clear the bar. Here is the ladder I use to keep the term honest — six levels, one dividing line.

The line between L2 and L3 is the entire argument. Below it, your code directs the process — the model is a component inside a pipeline someone wrote. Above it, the model directs the process — it decides what to do next, observes the result, and iterates. That loop is the machine; I wrote a whole piece on why the loop, not the model, is what "agent mode" actually is.

Two things worth saying plainly about the levels below the bar:

L2 is not an insult. Workflows with LLM steps are where most of the near-term enterprise value lives — they're deterministic, inspectable, cheap to review, and they ship. The problem is not building L2 systems. The problem is labeling them L3+ and then wondering why the governance doesn't fit.

L5 is where the original definition fully lives. The learning agent — improves its policy from outcomes — is the direct inheritance from the RL formalization. The "it must get smarter with every use" camp is describing L5. They're right that it's the ceiling. They're wrong to make it the floor: a system that decides its own actions and iterates against feedback (L3) is an agent by every definition in the lineage, even if its weights never move.

The diagnostic

If the ladder feels like too much machinery for a design review, use the one-line version:

If you can replace it with a well-written script and nobody notices, it was never an agent.

A script can call an LLM. A script can chain six LLM calls, branch on their outputs, and retry on failure. What a script cannot do is decide — at runtime, against a goal — which actions to take, in what order, and when to stop. If your "agent" has a flowchart, it's a workflow. If nobody can draw the flowchart because the model writes it fresh every run, now you have an agent — and a different governance problem.

This is the test I'd run on every line item in an AI portfolio review before arguing about anything else, and it echoes the definitional work I did in Agentic Architecture: Patterns That Scale — autonomy, persistence, goal-orientation — before the label inflation got this bad.

Why executives should care about a vocabulary fight

Because agent-washing misprices risk in both directions, and both directions cost money.

L2 workflows get over-governed. Call a deterministic pipeline an "agent" and it inherits the agent review path: action-scoping questionnaires, autonomy risk assessments, standing review boards — for a system whose control flow a reviewer could read in an afternoon. Cheap, safe wins die in queues built for a different class of system. The org concludes AI is slow, when what's slow is the mislabeled paperwork.

L3+ systems get under-governed. This is the direction that should keep risk officers up at night. When everything is an agent, the genuinely autonomous system — the one choosing its own actions against production systems — looks exactly like the chatbot on the intake form. It gets the same lightweight review, ships without action scoping or audit trails on its decisions, and the first anyone learns it could take a consequential action is when it takes one. Your risk committee can't price a system it can't classify — and right now the word "agent" classifies nothing.

And roadmaps inflate. Leadership hears "agent," pictures L5 — a system compounding in capability every quarter — and funds the roadmap on that picture. What shipped is a static L2 pipeline that will perform in Q4 exactly as it did in Q1, minus drift. The gap between the word and the system eventually surfaces as a credibility problem for the whole program, and the L2 system — which was good — takes the reputational hit for a promise it never made.

Govern the level, not the label

The fix is administrative, not architectural, which is why it can happen this quarter:

1. Label every AI initiative with its ladder level. In the intake form, the portfolio tracker, and the architecture review template. One field. L0–L5.
2. Tie the governance gate to the level. L0–L1: data-access review and not much else. L2: lightweight review — ship fast, this is where the safe wins live. L3: action scoping, audit trails on actions, a human gate on anything consequential. L4: all of that plus memory and state governance. L5: a standing eval program, because point-in-time certification of a system that changes underneath you is worthless.
3. Audit the current portfolio against it. Every system currently labeled "agent" gets placed honestly. Expect most of the portfolio to land at L1–L2 — that's not a failure, that's the correction working.

For the systems that genuinely clear the bar, the architecture that holds up in an enterprise is the one I described in Stochastic Core, Deterministic Shell: let the model direct the process inside a boundary that code enforces — action allowlists, typed contracts, human gates at the blast-radius edges. The ladder tells you which systems need that shell. The shell is how you govern them without strangling them.

Govern the autonomy, not the label.

The self-classification challenge

Take your flagship "agent" — the one in the board deck — and put it on the ladder.

Does code direct the process, or does the model? Does it hold state across sessions, or start cold every time? Has its policy improved from a single outcome it produced, ever?

What level is it — honestly?

If the answer is L2, you have something valuable that deserves a faster review path and a more truthful name. If the answer is L3 or above, the next question is whether its governance was built for what it actually is — or for the chatbot it was labeled as.

---

Sources for the lineage: Russell & Norvig, "Artificial Intelligence: A Modern Approach" (1st ed., 1995) — the rational agent. Wooldridge & Jennings, "Intelligent Agents: Theory and Practice," Knowledge Engineering Review (1995) — the weak notion of agency. Sutton & Barto, "Reinforcement Learning: An Introduction" (1998) — the agent–environment interface, building on MDP theory going back to Bellman (1957). Anthropic, "Building Effective Agents" (December 2024) — workflows vs. agents.