What is an AI agent
An AI agent is software that pursues a goal by selecting and taking actions with real-world effects, rather than only producing output for a human to act on. The governing distinction is not intelligence or autonomy — it is whether the software can cause something to happen without a human in between.
Get an Agent Trust Gap BriefThe definition, and why the usual ones fail
Most definitions of "AI agent" describe architecture — it plans, it uses tools, it has memory, it loops. Those are implementation details and they change every quarter. None of them tell you what controls the system needs.
The governing property is the actuator. A model that writes a beautifully reasoned email draft is a text generator. The same model wired to an SMTP credential is an agent, because it can now cause an irreversible event. Nothing about the model changed. Everything about the risk did.
| System | Can it act? | Governance needed |
|---|---|---|
| Chatbot answering questions | No | Content and privacy controls |
| RAG system over internal docs | No | Access control on the corpus |
| Copilot that drafts for human review | No — a human commits | Review quality, not action control |
| Agent with tool access that sends, pays, writes or dispatches | Yes | Policy gates, approvals, receipts, revocation, caps |
Autonomy is a spectrum; irreversibility is a cliff
Teams spend a lot of time debating how autonomous a system is. It is the wrong axis. A highly autonomous agent that can only read is low-risk. A barely autonomous agent with one tool that transfers money is not.
- Read-only actions — retrieval, analysis, classification. Risk is disclosure, not action. Control with access scoping.
- Reversible writes — drafts, internal records, proposals. Risk is noise and cleanup cost. Control with rate limits and tagging.
- Irreversible actions — sends, payments, dispatches, submissions, external state changes. Risk is unbounded. Control with approval gates, caps, receipts and revocation.
The whole of agent governance is deciding which bucket each action falls into and applying the matching control. See governed automation by workload for how that plays out in practice.
Why regulators do not use the word
Almost no regulation names "AI agents" as a category, which leads teams to conclude they are unregulated. The opposite is true: obligations attach to effects, and an agent produces effects. An automated decision with legal significance is governed whether the software is called an agent, a workflow or a script. Singapore and DIFC are the notable exceptions — both address autonomous systems directly. See governance by region.
Common questions
What makes something an AI agent rather than a chatbot?
The ability to take an action with a real effect. A chatbot produces text a human acts on. An agent acts. The model can be identical; the actuator is what changes the risk profile.
Is an AI agent the same as agentic AI?
The terms are used interchangeably. 'Agentic' usually emphasises planning and multi-step execution, but for governance purposes the operative question is the same: can it act without a human in between?
Do regulations mention AI agents?
Rarely by name. Obligations attach to effects — automated decisions, personal data processing, financial actions — regardless of the label on the software. Singapore's agentic framework and DIFC Regulation 10 are the main exceptions.
Does more autonomy mean more risk?
Not directly. A very autonomous read-only agent is low-risk; a barely autonomous agent with payment access is not. Irreversibility drives risk far more than autonomy does.
How do I know if we have agents in production?
Look for credentials issued to non-human identities that can write, send or pay. If a service account can email customers or move money on a schedule nobody approves individually, you have an agent regardless of what the team calls it.
Last verified 2026-08-07. Sources are named inline. Not legal advice.
By Julian Joseph, Founder, ApexClaw. Written from direct work operating autonomous systems under governance. Reviewed against the claims policy: sourced, first-party, or labelled.