Agent, Bot, or Just Software? What People Actually Mean by AI Agent

Ask five vendors what an "AI agent" is and you will get five answers. There is no settled definition yet, and that is not a pedantic problem. If you cannot say what an agent is, you cannot say which of the AI tools already running in your company are agents, and you cannot decide what to govern.

This is a plain-language field guide for the CISO, the CIO, and the CTO: where the word comes from, a definition that holds up, the types you will actually meet, and what an agent looks like under the hood from the first prompt to the moment it changes something.

We have been naming these for decades

The idea of software that acts on our behalf is old. We just kept renaming it as it got more capable.

All of these take actions. So what is actually new? In every case above, a human wrote the steps in advance. The software followed them. The new thing is that the model now chooses the steps itself, at runtime, based on what it sees. That is the line that separates an agent from everything we built before.

A working definition

Contrast that with a fixed workflow, where code dictates every step and the model, if there is one, only fills in a blank. The industry draws the same line: predefined workflows on one side, and agents whose model directs its own process and tool use on the other. Whether the screen looks like a chat window is beside the point. What matters is whether the system is deciding and executing, or just answering.

One more distinction worth keeping. The model is not the whole agent. Around it sits software, often called the runtime or the harness, that connects the model to tools, manages the session, and enforces whatever permissions exist. So "is it an agent?" is not a property of the model alone. It depends on what the runtime lets it reach and do.

The types you will actually meet

"Agent" is a category, not a product. In practice you will run into a handful of distinct shapes, and they carry different risk:

There is also a scheduling axis that cuts across all of them: some are started by a person, others wake up on a schedule or a trigger and run unattended. Autonomy (how much it does on its own) and how it is started are different questions, and both matter more than the brand on the window.

From the first prompt to tool execution

Under the hood, most agents run the same loop. It starts with a goal and does not stop at a single answer:

Two things about that loop matter for anyone responsible for risk. First, step 3 is where the agent leaves the model and touches your world: a shell command, a file write, a web request, a call to an external tool over MCP. That is the moment a governance decision is either made or missed. Second, the loop can branch. A step can spin up a sub-worker with its own context that does part of the job and returns a short summary. The agent's final "Done" is a summary of the outcome, not a full transcript of everything the sub-workers executed.

Why the definition matters

The reason to get this right is not vocabulary. It is that the risk lives inside that loop, not on the label. Two tools can both be called "an agent" and carry completely different exposure depending on which tools the loop can reach, what it is allowed to execute, and whether anyone can see or stop step 3.

So the useful question is never "is this branded as an agent?" It is "is a model choosing and executing steps here, and what can it touch when it does?" Govern that, and the label stops mattering. We wrote about the governance side of this in When AI Starts Executing: the tool is temporary, the consequences are not, and observing an action after it ran is not the same as being able to stop it before it does.

At KonaSense, that is the unit we work in: not the product name on the window, but the loop underneath it, and the moment it reaches out to act.