What is agentic AI?

By Harnoor Minhas · Last reviewed 2026-09-12 · Reviewed quarterly · An explainer from The Agent Signal, the daily AI newsletter.

The word arrived in 2024, went into every product announcement in 2025, and by 2026 means everything from "our chatbot can now book a table" to "a fleet of programs runs our returns department overnight". Both are technically agentic. The useful question is not whether something is agentic but how agentic, which is why this page spends most of its length on levels rather than on the label.

On this page

1. The definition, unpacked
2. How agentic AI works
3. Agentic AI vs AI agents vs generative AI
4. The six levels of agentic AI
5. Examples in 2026
6. Use cases
7. Risks and limits
8. FAQ

The definition, unpacked

"Agentic" is borrowed from psychology, where agency means the capacity to act on one's own intentions. Applied to software it points at five properties. A system is more agentic the more of them it has, and the more strongly.

1. Goal-directed. It is given outcomes, not instructions. "Reduce our cloud bill by ten percent without touching production" rather than "list the idle instances".
2. Planning. It decomposes the outcome into steps and revises the plan as it learns. Planning is what separates an agentic system from a fixed automation that happens to call a language model.
3. Tool use. It acts on the world through tools — APIs, browsers, code execution, other agents — rather than only producing text for a person to act on.
4. Self-monitoring. It checks whether each step worked, and whether the goal is closer, without a human asking. Reflection, verification and retries are all forms of this.
5. Bounded autonomy. It operates without step-by-step approval, within limits set in advance: which tools, how much money, how long, and which actions require a person. The autonomy is real; so are the bounds.

Notice what is not on the list: consciousness, general intelligence, or "wanting" anything. Agentic AI is an engineering pattern. The language models inside it have no goals of their own; they have the goal in the prompt and the tools in the context window. Confusing agentic with sentient leads to bad decisions in both directions — over-trusting the system's judgement and under-investing in the guardrails that actually make it safe.

How agentic AI works

A single AI agent runs a loop: read the goal, plan, pick a tool, execute, observe, repeat. (That loop is spelled out step by step in What is an AI agent?.) An agentic system is what you get when you wrap that loop in four more layers.

1. Orchestration

Someone has to decide which agent does what. In the simplest agentic systems that is a single orchestrator agent that reads the goal, splits it into sub-tasks, dispatches each to a specialist, and assembles the results. Common shapes: a planner–executor pair, where one model writes the plan and cheaper models carry it out; a supervisor that routes requests to the right specialist; and a pipeline, where agents hand work down a fixed sequence with the option to send it back. Frameworks that provide these shapes off the shelf appear constantly; the Open-Source AI Agents lane exists largely to track them.

2. Tools and protocols

Agents act through tools, and the tools need to be described in a way a model can read. The Model Context Protocol (MCP) has become the common way to expose a tool — a database, a ticketing system, a file store — so any agent can discover and call it. Alongside it sit agent-to-agent protocols that let one vendor's agent hand a task to another's. Standardised tools are what turn a demo into a system: without them every integration is bespoke, and bespoke integrations are where agentic projects die.

3. Memory and state

A language model forgets everything when the context window ends. Agentic systems keep state outside the model: short-term working memory for the current task, long-term memory for preferences and past outcomes, and shared state so that several agents can see the same picture. Getting this right is unglamorous and decisive — most "the agent did something weird" reports trace back to state the agent could not see.

4. Guardrails, evaluation and the human checkpoint

The runtime — ordinary software, not the model — enforces the bounds: which tools are allowed, spending caps, time and step limits, input and output checks, and a list of actions that always pause for a person. Evaluation runs alongside: automated tests of the agent's outputs on known cases, traces of every decision, and metrics that show drift. In mature deployments the human checkpoint is designed, not improvised: a queue of proposed actions a person approves in seconds, rather than a pop-up the agent hits at 3 a.m.

Put together: a goal enters; the orchestrator plans and dispatches; specialist agents loop through tools, reading and writing shared state; the runtime enforces limits and logs everything; humans review at defined checkpoints; the result is delivered and evaluated. That is agentic AI in one paragraph. Everything the vendors announce is a variation on it.

Agentic AI vs AI agents vs generative AI

The three terms are nested, not competing. The table sets them side by side; the rest of this section explains why the distinction matters in practice.

Why it matters: the three levels need different things from you. Generative AI needs a good prompt and a reader. An AI agent needs a well-bounded task and a way to verify the result. Agentic AI needs an architecture — orchestration, tools, state, guardrails, evaluation — and an organisation willing to own it. Teams that buy "agentic" while budgeting for "generative" are the ones who write the post-mortems.

The six levels of agentic AI

Borrowing the idea from driving automation, where "self-driving" is graded from 0 to 5 (SAE J3016), here is a six-level ladder for agentic systems. It is our framing, chosen because it matches how deployments actually progress, and it is the vocabulary we use across The Agent Signal when a lane reports that a product moved "up a level".

Level 0 — Generative

The model answers. No tools, no loop, no memory beyond the conversation. This is the chat box. Human does everything except the writing.

Level 1 — Tool-using assistant

The model can call tools — search, calculator, a single API — inside one reply, but each call is triggered by the current message and the person stays in the loop turn by turn. Most "AI features" in mainstream software sit here.

Level 2 — Task agent

Given a bounded task, the agent loops through multiple tool calls on its own until done, then reports. A coding agent that fixes a test, a research mode that produces a cited report. Human sets the task and reviews the output; the middle is autonomous.

Level 3 — Workflow agent

The agent runs a multi-stage process end to end — intake, processing, decision, output — with memory across stages and defined checkpoints where a person approves specific actions. Support triage that resolves routine cases and escalates the rest. Human supervises exceptions, not every case.

Level 4 — Multi-agent system

Several specialised agents coordinate under an orchestrator, share state, delegate, and recover from one another's failures. The system handles a whole function — a returns department, a data-pipeline team — with humans setting policy and reviewing outcomes in aggregate. This is what most vendors mean by "agentic" in 2026, and what few have running in production at scale.

Level 5 — Self-improving system

The system monitors its own performance, proposes and tests changes to its prompts, tools or routing, and adopts what works — within limits a person sets. Genuine Level 5 deployments are rare and are, correctly, watched closely by safety researchers; most claims are Level 4 with a dashboard. Our AI Safety Signal and Frontier AI Research lanes cover this frontier daily.

Two observations from watching the ladder. First, value and risk both rise with level, but not evenly: the jump from 2 to 3 is where the money is for most businesses, and the jump from 3 to 4 is where the incidents are. Second, a system's level is set by its weakest guardrail, not its strongest demo. A Level 4 architecture with a Level 1 approval process is a Level 1 system with extra ways to fail.

Examples of agentic AI in 2026

Named to identify, not to endorse; The Agent Signal is not affiliated with any company mentioned.

• Software engineering at Level 2–3. Coding agents from Anthropic, OpenAI, Google and a crowd of open-source projects now take an issue, plan the change, edit across files, run tests, and open a reviewed pull request. Teams chain them — one agent writes, another reviews, a third checks security — and that chain is a Level 3 workflow. Daily movement is in Agentic AI Edge and the vendor lanes for Claude, OpenAI and Gemini.
• Deep research as a Level 2 agent. The research modes in the major assistants plan a set of searches, read dozens of pages, cross-check, and produce a report with citations over several minutes without further prompting.
• Customer operations at Level 3. Support platforms ship agents that read a ticket, look up the account, apply policy, resolve routine cases (refund within limit, reset, reschedule) and hand the rest to a person with a summary. The measurable output is the share of tickets resolved without a human touch, and the honest vendors publish it per customer, not as a headline number.
• Cloud and data operations at Level 3–4. Agents that watch cost and reliability signals, propose infrastructure changes, apply the approved ones and verify the effect — covered in Hyperscale Cloud AI and, for the hardware layer, The AI Chip Foundry.
• Open-weight agentic stacks. Companies that cannot send data to a hosted model run the whole loop on open-weight models locally, using open frameworks and MCP servers. Model releases that matter for this are tracked in Open Weights and, for the Chinese labs that publish many of them, The China Agent Signal.
• Physical agentic systems. Warehouse and factory robots whose planning layer is now a language-and-vision model, coordinated by a fleet orchestrator. Same ladder, higher stakes; see Embodied AI Robots.
• Creative pipelines. Agentic workflows that take a brief, generate images, video and audio with several models, check each against the brief, and assemble a deliverable — covered in Creative Agent Signal.

Use cases: where agentic AI pays

The pattern across every case that works: a process with clear inputs and outputs, enough variation that a rules engine would fail, a way to verify results, and a person who owns the outcome. In rough order of maturity:

1. Software delivery. Maintenance, migrations, test coverage, code review. Verifiable by tests; the most mature agentic use case by a distance.
2. Back-office operations. Invoice processing, reconciliation, onboarding paperwork, compliance checks. High volume, clear policy, checkable outputs.
3. Customer support. Tier-one resolution with escalation. Works when the allowed actions are narrow and the handoff is fast.
4. Research and intelligence. Market monitoring, competitive analysis, literature review, due diligence. This site is itself an example: it tracks sources, drafts, checks and publishes — with a human editor at every checkpoint. The method is described at How we make it.
5. IT and cloud operations. Incident triage, cost optimisation, patching, with change approval gates.
6. Sales and marketing operations. Lead enrichment, personalised drafting, campaign assembly. Drafting is safe; autonomous sending is where reputations go.
7. Personal productivity. Inbox, calendar, travel, expenses for one person who reviews before anything leaves. Useful, and the category with the sharpest privacy questions because the agent sees everything.

For a founder or operator deciding where to start, the answer is almost always "the most boring Level 3 workflow you have". The AI Operator lane covers funding, strategy and policy for exactly that decision, and AI at Work covers the tooling.

Risks and limits

Agentic AI inherits every risk of AI agents and adds the ones that come from scale and coordination.

• Compounding error. Reliability multiplies across steps and across agents. A workflow of twenty 95%-reliable steps completes cleanly about a third of the time. Verification at each stage, not just at the end, is the fix; it is also the cost.
• Prompt injection at system scale. Any agent that reads outside content (see the OWASP Top 10 for LLM Applications) — web pages, emails, documents, another agent's output — can be handed instructions by that content. In a multi-agent system one compromised input can propagate. The defence is architectural: treat everything observed as data, restrict what each agent may do, and keep irreversible actions behind a human gate.
• Emergent behaviour between agents. Two well-behaved agents can loop, contradict or amplify each other. Shared state, explicit termination rules and traces of every hand-off are the minimum.
• Accountability and audit. When a system of agents makes a decision, "why" must be answerable. Risk frameworks such as the NIST AI RMF and regulators in several jurisdictions are converging on logging, human oversight and impact assessment requirements for autonomous systems; the daily trail is in AI Safety Signal.
• Cost and runaway autonomy. Without budgets, step limits and timeouts, an agentic system that cannot finish will spend until stopped. Caps are not optional at any level above 1.
• Vendor lock-in through tools. The tool layer is where lock-in now happens. Open protocols such as MCP reduce it; proprietary agent platforms with proprietary tool formats increase it. Worth weighing before the architecture sets.
• Organisational readiness. The most common failure is not technical. A Level 3 system deployed into a team that still approves every action by email is a slower version of the old process. Design the supervision before the system.
• Hype gap. "Agentic" is on every slide; Level 4 in production is rare. Ask any vendor which level their system runs at, what the human checkpoints are, and what their per-customer resolution or success rate is. Vague answers are an answer.

Keeping up

This page defines the term and will be reviewed quarterly. What moved today is in the lanes: Agentic AI Edge for the ecosystem, The AI Agent Stack for architecture and vendor strategy, Open-Source AI Agents for frameworks and MCP, and Agent Signal News for the day's headline set. Beginners may prefer The AI Shortcut. If you are comparing newsletters, we ranked ours against the competition, honestly, in The 21 Best AI Newsletters.

Sources and further reading

The workflow-versus-agent distinction and the five properties draw on the two vendor guides; the level ladder borrows its structure from SAE J3016; the risk list follows OWASP and NIST. Links were checked on 2026-09-12.

• Anthropic, "Building effective agents" (December 2024)
• OpenAI, "A practical guide to building agents" (PDF, 2025)
• Yao et al., "ReAct: Synergizing Reasoning and Acting in Language Models" (2022)
• Model Context Protocol — specification and documentation
• SAE J3016 — Levels of Driving Automation
• OWASP Top 10 for Large Language Model Applications
• NIST AI Risk Management Framework
• Russell & Norvig, Artificial Intelligence: A Modern Approach

Frequently asked questions

Author: Harnoor Minhas — TODO-HIS-BIO. Vendor and product names are used nominatively to identify what is described; The Agent Signal is not affiliated with or endorsed by any company named. Last reviewed 2026-09-12; next scheduled review 2026-12.