What is an agent?
An agent is a model in a loop. It has its own context, its own tools, and a defined role, and it keeps working (deciding, acting, reading the result, deciding again) until the job is done or it concludes it can’t be. Every product that calls itself “agentic” is some version of that sentence. Hold onto the definition and the marketing gets much easier to see through.
The definition is tool-agnostic on purpose. Claude Code subagents, Codex tasks, Copilot’s coding agent, a Python script calling a model API in a while loop: same anatomy, different packaging.
Chat vs. agent
Section titled “Chat vs. agent”In a chat, you are the loop. You ask, the model answers, you read the answer, you decide what to ask next. The model never acts between your messages. An agent internalizes that cycle:
| Chat | Agent | |
|---|---|---|
| Context | The conversation you’re both looking at | Its own working context, assembled for the task |
| Tools | None. You paste results in by hand | Its own: read files, run commands, call APIs |
| Role | General assistant, redefined every message | A defined job with a done-condition |
| Loop | You, one message at a time | The model itself, until the task ends |
Those four properties (own context, own tools, own role, a loop) are the test. Remove any one and you have something else: a chat, a search box, or a script.
The agentic loop
Section titled “The agentic loop”Strip away the branding and every agent runs the same short cycle: perceive the task and the current state, decide the next action (the one model step, where judgment enters), act by invoking a tool, then observe the result as it lands back in context. Then it repeats, the output of one action feeding the next decision with no human relaying it. That is what makes it an agent, and it’s also where the risk concentrates: a wrong observation steers every decision after it, with nobody between the steps to notice. The underlying read-decide-act mechanics are the same ones in How AI coding tools work, one level up.
Tools are model-controlled
Section titled “Tools are model-controlled”The Model Context Protocol, the emerging standard for wiring tools to models, is explicit about who’s in charge: tools are model-controlled. The model decides when to call them and with what arguments. That’s the entire point, and it’s also why the same spec insists there should always be a human in the loop with the ability to deny tool invocations.
Why isolation matters
Section titled “Why isolation matters”Each agent has its own context window, and that context dies with it. A subagent that reads two hundred files to answer one question burns its own window doing so; your main session receives only the conclusion. That’s the good news: isolation is how you spend context on exploration without polluting the context that matters. Recall The context window: the same budget logic, one level up.
The flip side: whatever an isolated agent learned and didn’t write down is gone when it exits. If a subagent should leave something behind (a finding, a decision, a file), that has to be an explicit output, not an assumption. Design agents like functions: inputs in, results out, no shared memory unless you build one deliberately.
An agent is not a single automated step
Section titled “An agent is not a single automated step”A script that runs your tests on every commit is automation. It is not an agent: there’s no judgment in it, and that’s its virtue. It does the same thing every time, and you can trust it because of that.
Reach for an agent only where the next step genuinely depends on judging the previous one: triaging a failure, deciding which of forty files is the real cause, drafting the fix. The 12-factor-agents principles put it plainly: production agents are mostly deterministic code with small LLM steps placed where judgment pays, and small, focused agents beat one sprawling do-everything loop. An agent where a script would do pays model prices (cost, latency, unpredictability) for a decision nobody needed made.
That boundary between deterministic code and model steps is the single most useful design question in this track. Determinism vs. judgment is dedicated to it.
The definition, once more
Section titled “The definition, once more”Own context. Own tools. Own role. A loop. If a vendor’s “agent” is missing one of those, name what it actually is and evaluate it as that. And once something really is an agent, the next question is never what can it do. It’s what stops it from doing the wrong thing. That’s enforcement, and it’s where the track goes next.
Sources: 12-factor-agents (small, focused agents; mostly-deterministic control flow), MCP specification: tools (model-controlled tools; human ability to deny invocations).