Agents act — so autonomy must be earned one rung at a time
AI agents and orchestration: from chat to workflows
The question: When should AI move from answering questions to taking action?
Agentic AI is the enterprise frontier: McKinsey finds 23% of firms scaling an agentic system somewhere, but under 10% at scale in any single function. The winners understand autonomy levels, tool permissions, and failure containment before they need them.
What the lesson covers
An agent = model reasoning + tools + memory + a planning loop + environment feedback. A chatbot answers; an agent pursues a goal: it decides which tool to call (search, database, email, code), observes results, and iterates. That single difference — outputs become actions — changes the risk class entirely.
Distinguish the spectrum: copilots (human triggers each step), assistants (multi-step but human-approved), workflows (predefined steps with AI inside — predictable, testable), and agents (dynamically self-directed). Anthropic's engineering guidance is blunt and correct: most business value today comes from bounded workflows, not open-ended autonomy — use the simplest pattern that works.
The Autonomy Ladder is the design tool: draft → recommend → execute with approval → execute with audit → autonomous within constraints. Place every action an agent could take on a rung, based on reversibility and blast radius. Sending an internal Slack draft and issuing a customer refund do not belong on the same rung. Agents earn higher rungs with evidence (eval results, incident-free volume), not enthusiasm.
Agent risks are specific: runaway loops (cost and actions), tool misuse, prompt injection via retrieved content or web pages (now with hands), data exfiltration, poor recovery from errors, and accountability gaps ("the agent did it" is not a defence). Multi-agent systems (role-based like CrewAI, graph-based like LangGraph) multiply coordination surface — powerful for parallel work, harder to audit.
Containment is engineering: least-privilege tool permissions, sandboxing, spending/action caps, human checkpoints at irreversible steps, full audit logs, rollback paths, kill switches, and eval suites that test the workflow end-to-end. Observability isn't optional: if you cannot replay what an agent did and why, you cannot run it in production.
Key points
- Agent = reasoning + tools + memory + planning loop; outputs become actions — a different risk class.
- Prefer bounded workflows over open autonomy; use the simplest pattern that works.
- Place every action on the Autonomy Ladder by reversibility × impact; promote with evidence.
- Specific risks: runaway loops, prompt injection with hands, exfiltration, accountability gaps.
- Containment = least privilege, caps, checkpoints, logs, rollback, kill switch, end-to-end evals.
Framework — Autonomy Ladder
draft → recommend → execute with approval → execute with audit → autonomous within constraints. Assign every agent action a rung by reversibility × impact; promotion between rungs requires evaluation evidence and audit history, not vibes.
The lab
Design a safe first agent: workflow map, permissions, and failure containment.
Open this lesson, its lab and its quiz
Sources and further reading
- Building effective agents — Anthropic
- OWASP LLM Top 10 — excessive agency — OWASP
- Work Trend Index — agents & the frontier firm — Microsoft