What is an AI agent? the definition, the parts and the limits of its autonomy
An AI agent is a language model that has been given access to your systems and the right to act in them. It is not a program with a list of instructions, and it is not a chat window. Below: the definition without jargon, the five parts an agent is built from, where its autonomy ends, a worked example from a question to a saved change in a system, and the list of things an agent will not do.
- 5 partswhat an AI agent is built from: the model, tools into your systems, your company data, permissions and a call log
- 5 to 10 secondshow long BOND takes to answer a question about company data, including querying the connected systems
- 5 stepswhat the agent runs through in the example below, from a question typed as a plain sentence to a saved change in a system
- EUR 0.005 to 0.07the cost of a single query to a language model, paid to the model provider directly, outside our invoice
Short answer
What is an AI agent and how is it different from an ordinary program?
An AI agent is a language model wired to tools that reach into your systems, plus permissions that say what it may do in them. It answers from data read at the moment you ask, not from the model's memory, and it can then save the result: a note in the CRM, a task, a document.
An ordinary program runs instructions somebody wrote step by step. An agent gets a goal in one sentence and works out the order of the steps itself, from the tools it has been given. A model in a chat window does neither: it answers from training data and from whatever you paste in.
Want to know whether your company needs one? One question: does the answer to the thing you ask every day have to come out of a system. If it does, that is work for an agent. If it does not, a chat window is enough.
How is an AI agent different from an ordinary program?
An ordinary program and a classic automation share one trait: somebody wrote every branch in advance. A flow in Make or n8n looks the same on the first run and on the thousandth. That is a strength, as long as reality fits the diagram.
An AI agent gets a goal and a list of tools, and works out the steps on every question. Asked about something nobody planned for, it looks for another route instead of stopping on an error. The flip side of the same trait: two runs of the same question can take different paths. Which is why the log is not an extra here.
- Ordinary program: a person writes the steps, the program replays them, the result is the same every time
- Automation in Make, n8n or Zapier: the same diagram, fired by an event such as an order
- AI agent: a person writes the goal, the boundaries and the tools, the agent picks the steps on each question
- Model in a chat window: no tools and no access to systems, so it answers from memory and from what you paste
- Practical test: ask the vendor where the answer comes from and what the tool is allowed to write. The product name settles nothing.
What is an AI agent made of?
Five parts, and none of them is optional. A model with no tools is a chat window. Tools with no permissions are a risk. Permissions with no log leave you with one person's word against another's at the first dispute.
Most of the work sits in the third row, your company data. The model is ready, the integrations are standard, and which customer record is the true one gets decided at your end. That is the part we set up before anything is connected to BOND, our company AI agent.
| Part of the agent | What it is in practice | What breaks without it |
|---|---|---|
| Language model | Claude, GPT or Gemini: understands a question asked as a plain sentence and plans the steps | the tool handles only the questions somebody put in the form |
| Tools into your systems | API calls to the CRM, the invoicing system, a spreadsheet or a SQL database, described so the model knows when to use them | the model answers from training data, which means it guesses |
| Company data | named sources of truth: which system holds the current price, where the customer history lives | the agent hits duplicates and stale records, and the answer sounds confident and is wrong |
| Permissions | scope per system and per role: what it reads, what it writes, what it will not do without approval | one bug in the write logic scrambles your data and nobody knows which records it touched |
| Call log | every question, every system query and every write, with a timestamp and an author | there is no way to reconstruct where an answer came from or who approved a change |
The order is deliberate, and it is the order we work in during a workshop: sources of truth and permissions first, the choice of model after. The mechanism a model uses to fetch data instead of guessing is called a tool call, and it sits in the API layer, not in the chat window. The open standard for describing such tools is <a href="/en/guides/mcp-model-context-protocol/">MCP</a>.
What does it mean that an AI agent works on its own?
It means it picks the order of the steps inside boundaries you set. It does not pick goals, it does not grant itself access to further systems, and it does not decide what is good for the company. Autonomy is a setting in the project, not a property of the technology.
You draw the line before go-live, not after the first incident. We sort operations into three buckets: read, reversible write, irreversible write. The third one always goes through a person.
- Does it alone: queries systems, joins data from several sources, keeps to a schedule, prepares a document for approval
- Does it alone because it can be undone: a note in the CRM, a task for the team, a row in a working spreadsheet
- Does not do alone: anything sent to a customer, a credit note, a price change, anything irreversible
- Never does: grant itself permissions, or reach into a system it was not let into
What does the path from question to finished action look like?
One example, in steps, because it separates an agent from a chat better than any definition does. A salesperson types a plain sentence: „Has Harper Ltd paid the September invoice, and can I release the next order?”. The answer sits in two systems he has no access to himself.
Breaking the question apart
The model splits the sentence into two things: the payment status of an invoice and the customer's credit limit. It sets the order, because without a customer identifier there is nothing to look the invoice up by.
Querying the CRM
The agent asks the CRM about Harper Ltd and gets one matching record with a VAT number and a credit limit. If two records matched, it asks the salesperson which one it is, instead of choosing for him.
Querying the invoicing system
With the VAT number it goes to the invoicing system for the September invoices and their payment status. That is data from this moment, not from a spreadsheet export somebody made on Monday.
Assembling the answer with its sources
The salesperson gets one sentence: the invoice dated 12 September is unpaid, nine days past due, four fifths of the credit limit used, plus the names of the source systems. It takes 5 to 10 seconds.
Action and write
The agent saves a note in the CRM and opens a task for finance, because both writes can be undone. It will not send the customer a message: that bucket needs a human click.
What can an AI agent not do?
The list is shorter than a sceptic says and longer than a salesperson says. The common thread: an agent works on what can be read out of a system and on rules somebody wrote down.
The second item comes back in every workshop: an agent does not fix a process. When two people enter the same kind of order in two different places, the agent learns to query both and makes the split permanent. Hence the order of work: process first, tools second.
- Knows nothing that is not in the connected systems; a decision made in a corridor does not exist for an agent
- Cannot read a system with no API, or a scan that is an image with no text layer
- Cannot rule which of two contradictory records is true; it returns both and asks you to name the source
- Does not carry responsibility for a decision: a person signs it, including when the agent supplied the data
- Does not replace a conversation that is about the relationship rather than the data: a negotiation, a hard complaint
What does an AI agent cost and where do you start?
We publish one price: the process workshop at EUR 3,500 net per week, usually 1 to 7 weeks. The build is quoted after the workshop, because only then do you know what the APIs of your systems can actually do. What the week covers is on the process workshop page.
It starts with one question that comes back every day, not with a project called „we are adopting AI”. The method is the same each time: workshop, pilot on real data, production, measurement after 30 and 90 days. We take at most two implementations at a time. The company agent for a whole team is BOND.
- Process workshop: EUR 3,500 net per week, ends with a process map and a 30-day plan
- Build: quoted after the workshop, driven by how many systems there are and how good their APIs are
- Model queries: EUR 0.005 to 0.07 per query, paid to the model provider directly
- Tool licences: per the vendor price list; n8n self-hosted carries no licence fee
- Your team's time: a few hours per person for testing and for learning how to ask, usually left out of the calculation
Common mistakes
Five misunderstandings about AI agents
Treating an AI agent as a better chat window
The company buys more expensive subscriptions and waits for the answers to start coming from its own systems. They will not: connecting the CRM is a separate project on the API side, not a higher plan.
Deploying an agent on a process nobody has written down
The agent cements the workarounds and exceptions the team invented over the years. Three months in, nobody can say why an answer looks the way it does.
Full permissions from day one, because it is faster that way
The first bug in the write logic scrambles the CRM and nobody knows which records it touched. A pilot starts read-only, and write rights get added field by field.
Judging an agent on a demo run on sample data
On your data, with duplicate customers and empty fields, the same configuration behaves differently. That is why the pilot runs on real data, before anything is signed.
No call log, and nobody who reads it
The first disputed write leaves you with one person's word against another's. The log is the cheap part of an implementation and the only part that lets you reconstruct where an answer came from.
Checklist
Checklist before you decide you need an AI agent
If any line is a no, this is not the moment to implement one.
- One question written down that comes back every day and needs somebody to open a system
- The system the answer has to come from named, with its API confirmed
- Checked that the data in that system is current and free of duplicates
- Agreed what the agent reads and what it may write, per system and per role
- The operations the agent will not run without human approval written down
- The call log switched on and a named person who reviews it
- The metric for the 30-day and 90-day reading chosen before the start, not after
Sources
Sources
- Regulation 2024/1689 (AI Act), art. 3: the legal definition of an AI system
- Model Context Protocol: the open standard for describing the tools an agent uses
- OpenAI developer documentation: tool calling is an API layer, not a chat window feature
- Anthropic, Claude model pricing: the per-query cost is paid to the provider directly
- JustAutomate, BOND: the company AI agent answering from your company data
Let us try it on one of your questions
Process first. Tools second.
On a free 30-minute consultation we take one question that comes back at your company every day and show, on sample data, how an AI agent gets to the answer. Without connecting your systems. If a simpler automation is enough, we will say so on the call. The process workshop costs EUR 3,500 net per week. You are writing to Paweł, the founder.
Book a free consultationFrequently asked questions
What is an AI agent?
An AI agent is a language model wired to tools that reach into your company systems, plus permissions that say what it may do in them. It answers from data read at the moment you ask, and it can save the result of the conversation. An ordinary program replays steps a person wrote down; an agent works the steps out itself.
How is an AI agent different from a chatbot?
A chatbot returns content: typed in beforehand, or assembled from your documents. An AI agent queries live systems and can carry out an operation, for example change a record or open a ticket. The question that settles it: does the tool have write access to your systems.
Does an AI agent work without a person involved?
Within the boundaries somebody set for it. Reads, and writes that can be undone, the agent does on its own. Irreversible operations, such as sending a message to a customer or issuing a credit note, go through human approval. That is a setting in the project, not a property of the technology.
Does an AI agent need access to our data?
Yes, otherwise it answers from the model's memory, which means it guesses. Access is granted per system and per role: what it reads, what it writes, what it will not do without approval. Every call lands in the log, so you can check where an answer came from.
How much does an AI agent cost?
We publish one price: the process workshop at EUR 3,500 net per week, usually 1 to 7 weeks. The build is quoted after the workshop, once the APIs are known. On top of that come the model queries, EUR 0.005 to 0.07 each, paid to the model provider directly.
How fast does an AI agent answer a question about company data?
BOND, our company AI agent, comes back in 5 to 10 seconds, because that is how long it takes to query the connected systems. Checking the same thing by hand in the CRM and the invoicing system takes several minutes. The difference shows on the questions that come back every day.
Can an AI agent get it wrong?
It can, which is why what counts is how often it admits it does not have the data instead of guessing. A wrong sentence is a misunderstanding; a wrong write costs more, so the scope of permissions is agreed before go-live. Calls land in the log, so you can reconstruct what was written and when.