When AI drafts an email, somebody can review the mistake before it leaves the company. Give the same assistant access to the CRM and a Send button, and the same mistake now changes the world outside the chat. The model has not necessarily become worse. Its output has acquired consequences.
An AI agent differs from a text assistant because it can select and use tools in pursuit of a goal. That makes writing quality only one part of the architecture problem.
Automating actions, not just answers
A staff member might ask an agent to find overdue invoices, check ownership and prepare reminders. The agent reads data, selects recipients, drafts messages and may make several tool calls in sequence.
The business benefit comes from fewer manual transfers between systems. But in a longer chain, a mistaken interpretation at one step can affect every step that follows.
Permissions must survive a model mistake
A prompt is not an access-control system. When an agent calls an API, that API must check identity, resource ownership and whether the requested operation is allowed. Separate reading from writing, minimise available tools and carry the initiator's identity through important operations.
A universal technical credential with broad access is particularly dangerous. An agent may mistake instructions hidden in an email or retrieved document for something the user wants. That is prompt injection, not authorisation.
Approving what is hard to undo
Preparing an invoice and paying it carry different risks. For money, access rights and external commitments, a real human approval or deterministic rule may be needed before execution.
The approval screen must show the actual customer, amount, recipient and effect. A generic Approve All button buried among dozens of similar requests can turn human oversight into theatre.
State may change after approval, too. Recheck current permissions and parameters before executing consequential actions, and make retries safe through appropriate idempotency controls.
Limit the cost of mistakes as well as permissions
Agents need bounds on time, steps, spending and tool access. They need an action log that makes decisions traceable. Measure successfully completed business processes, not merely model invocations.
Not every workflow needs an agent. When the sequence is predictable and governed by clear rules, a conventional workflow may be cheaper, easier to test and more dependable.
The difference between an AI assistant and an AI agent is not model size. It is the authority to change things outside the conversation.
OWASP's LLM Top 10 includes Excessive Agency among the important security risks.