What Is an AI Agent? Tools, Memory, Planning, and Human Control

Direct answer

An AI agent is a system in which a model can choose actions, call tools, observe results, update state, and continue toward a goal. Tools give it reach; memory or state gives it continuity; planning organizes steps; permissions and checkpoints determine its real autonomy. The model is one component, not the whole agent.

Replace the digital-worker metaphor with a system diagram

Calling an agent a “digital employee” compresses the difficult parts—authority, competence, supervision, and liability—into a friendly metaphor. Draw the system instead.

Practitioner architectures distinguish fixed workflows, where code defines the sequence, from more dynamic agents, where a model decides how to proceed. ^{anthropic, toolformer, nist} Tool-use research shows how language models can learn or be trained to decide when and how to invoke external APIs. ^toolformer

This article gives non-engineers a precise vocabulary for evaluating agent proposals. It does not define a universal industry standard.

The agent control loop

An agent usually contains:

1. Goal: the task and completion condition.
2. State: what has happened, what remains, and relevant memory.
3. Model: proposes or selects the next step.
4. Tools: search, files, code, databases, messaging, or other APIs.
5. Observation: tool output returns to the loop.
6. Evaluator: checks whether a step or final result meets criteria.
7. Control: permissions, budgets, checkpoints, and stop rules.

In compact form:

goal → inspect state → choose action → call tool → observe → evaluate → continue, escalate, or stop

Agency is not a magic property of the model. It emerges because software repeatedly turns generated choices into executable actions.

Workflow, router, and agent

| Pattern | Who defines the next step? | Best fit | |---|---|---| | Fixed workflow | Developer or process designer | Stable, auditable sequences | | Model router | Model chooses among bounded paths | Variable inputs with known destinations | | Agent loop | Model dynamically chooses steps and tools | Open-ended tasks where the path cannot be fully specified |

Use the least dynamic pattern that handles the variability. A fixed extractor followed by a deterministic validator is often better than an agent that “figures it out.”

Memory is not understanding

“Memory” may mean conversation history, a database of past events, retrieved user preferences, or a task-state object. Each has different retention, privacy, and error risks.

A stale preference can misdirect future work. A compacted history can omit a restriction. Retrieved memory can belong to the wrong user. Define what is stored, why, for how long, how it is corrected, and whether it may influence action.

Planning is an output under evaluation

An agent may decompose a goal into steps before acting or plan incrementally after observations. Plans can improve coherence, but a plausible plan can contain unsafe assumptions. Separate:

• proposing a plan;
• approving a plan;
• executing one step;
• approving an irreversible effect.

For consequential work, do not let the same unchecked output both authorize and perform the action.

Why the evidence supports the Agent Control Loop and Autonomy Budget

Evidence snapshotModerate confidence

Research and current engineering practice support the core description of tool-using model loops. NIST supports mapping system roles, context, measurement, and risk controls. Evidence does not establish one best agent architecture or show that increasing autonomy reliably improves organizational outcomes.

^{anthropic, toolformer, nist}

Claim sources: ^{anthropic, toolformer, nist}

The autonomy budget

Define autonomy across five dimensions:

| Dimension | Low | High | |---|---|---| | Scope | One record | Many systems or users | | Permission | Read approved inputs | Write, send, spend, or delete | | Duration | One bounded run | Persistent background operation | | Discretion | Choose from fixed options | Invent goals or strategies | | Reversibility | Draft or sandbox | External, irreversible effect |

An agent need not be “fully autonomous” to be risky. One narrow permission—sending a message under a trusted identity—may matter more than sophisticated planning.

Define an autonomy budget before deployment

For one proposed agent:

1. Write the goal and explicit non-goals.
2. List every tool and minimum permission.
3. Label all incoming content by trust level.
4. Set cost, time, step, and retry budgets.
5. Define success, failure, and uncertainty states.
6. Place approval before external or irreversible effects.
7. Log actions and preserve an emergency stop.
8. Test representative failures and attacks before real access.

An agent review should end with a compact accountability map: which component proposes, which deterministic control validates, which human checkpoint approves, and which decision owner accepts residual risk. Include a representative test set covering routine work, missing information, conflicting instructions, tool failure, unauthorized requests, and stop conditions. The important evaluation is not whether the agent narrates a sensible plan; it is whether its observable actions stay within the mandate and recover safely when the plan is wrong.

Compare the pattern with AI Search vs Chatbots vs Agents. Model indirect attacks using Prompt Injection Explained, then design accountable handoffs with AI Workflow Design.

Agent language that hides engineering choices

• “It has memory” without a retention and correction policy.
• “A human is in the loop” without an approval boundary.
• “The agent plans” without a way to inspect or reject the plan.
• “It can use tools” without a permission inventory.
• “It learns from mistakes” when it merely stores unverified output.
• “Autonomous” without a budget, stop rule, or accountable owner.
• “Multi-agent” as a substitute for a clear task decomposition.

A moving category with real consequences

Limits and counterevidence

Agent terminology and product capabilities change quickly, and this article does not assess any named platform. Some systems conceal routing, memory, or tool behavior. The loop model also omits many production concerns, including identity, infrastructure security, monitoring, accessibility, and applicable law. Verify current system documentation and conduct a real security and domain review before granting access.

The useful question is not whether software deserves the title “agent.” It is which generated choice can reach which real-world power under whose authority.

Named sources

Evidence and further reading

1. Building Effective Agentspractitioner · accessed 2026-07-28
2. Language Models Can Teach Themselves to Use Toolsresearch · accessed 2026-07-28
3. NIST AI Risk Management Frameworkofficial · accessed 2026-07-28

Publication record

Published July 29, 2026. No substantive revision has been recorded. Evidence last verified July 28, 2026.