View source for Agentic AI

'''Agentic AI''' ('''agentic artificial intelligence''') refers to artificial intelligence systems that pursue defined goals by selecting, coordinating and carrying out actions across multiple steps, with some independence from continuous human direction. Such systems use one or more [[AI Agent|AI agents]] to gather information, determine what to do next, interact with permitted tools or environments, observe results and adjust their course. An agentic system may prepare recommendations, execute authorized software operations or coordinate several specialized agents; what it can actually do depends on its architecture, permissions and oversight.<ref name="oecd2026">Rendtorff-Smith, S., Rossi, F., Sugimoto, K., Aranda, L. and Corruble, V. (2026), ''Can we create a clear understanding of what agentic AI is and does?'', OECD.AI, 3 March 2026. [https://oecd.ai/en/wonk/what-agentic-ai-is-and-does OECD.AI]. The article identifies itself as expert analysis rather than an official view of OECD member countries. Accessed 9 November 2026.</ref><ref name="canada2026">Treasury Board of Canada Secretariat (2026), ''Guide on the Use of Agentic Artificial Intelligence'', Government of Canada, 15 September 2026. [https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/generative-ai/guide-use-agentic-artificial-antelligence.html Canada.ca]. Accessed 9 November 2026.</ref>

In plain language, agentic AI can go beyond giving an answer and attempt to complete a task. For example, instead of merely summarizing a service incident, a suitably authorized system could check relevant records, identify a permitted resolution path, prepare an action, seek approval where required, update a ticket and verify the result. Completing these steps reliably requires an operational system surrounding the AI model: tools, identity, access controls, records, monitoring and a way to stop or correct mistakes. The term describes '''goal-directed system behavior''', not the existence of human-like intentions or unrestricted decision-making.

The vocabulary is still developing. Some sources use ''agentic AI'' chiefly for coordinated '''multi-agent''' systems; others also include a '''single agent''' pursuing a multi-step objective. Accordingly, a system should be described by its actual agents, tasks, degree of autonomy and action permissions rather than by its marketing label alone.<ref name="euagent">European Commission, ''How are AI agents addressed within the AI Act?'', EU AI Act Service Desk, FAQ. [https://ai-act-service-desk.ec.europa.eu/en/ai-act/faq/how-are-ai-agents-addressed-within-ai-act-0 European Commission]. Explains that the terminology and boundary between AI agent and agentic AI remain unsettled. Accessed 9 November 2026.</ref> The closely related entry [[AI Agent]] describes an individual goal-directed software actor; this article explains the '''agentic approach and the behavior of complete agentic systems'''.

== Meaning and defining characteristics ==

The adjective ''agentic'' comes from ''agency'': the ability of a system to initiate or select actions in pursuit of an assigned objective. In artificial intelligence, this agency is functional and constrained. An agentic system is given a task or goal, observes information about a relevant environment, uses its available methods to select actions and incorporates what happens next. Its environment may consist of enterprise applications, documents, databases, simulated systems, digital interfaces or physical machinery. A human or another authorized system defines the operational envelope within which this behavior is allowed.

Agentic AI is not a single algorithm or product category with a universally agreed technical test. It is a family of system designs with varying combinations of reasoning, planning, tool use, state management, coordination and autonomy. Modern deployments frequently employ [[Large Language Model (LLM)|large language models]] to interpret natural-language goals and decide which tools to invoke. The broader concept of agent-based systems predates modern generative models, however, and not every agentic capability requires an LLM.<ref name="govuk2026">Government Digital Service (2026), ''AI Insights: Agentic AI'', UK Government, updated 3 August 2026. [https://www.gov.uk/government/publications/ai-insights/ai-insights-agentic-ai-html GOV.UK]. Accessed 9 November 2026.</ref>

The characteristics most relevant to identifying agentic behavior are:

* '''Goal orientation:''' the system pursues a defined outcome rather than producing an isolated output without subsequent task responsibility.
* '''Contextual observation:''' it reads information from tools, data sources, users, events or the environment and can respond to changes.
* '''Selection and planning:''' it can select a next step, tool or route through work within the boundaries of its design; the plan need not be wholly invented by a language model.
* '''Tool-mediated action:''' it can obtain information, submit a proposed operation, update an authorized record or interact with another system through defined interfaces.
* '''Feedback and continuation:''' the result of one step can influence the next, including correction, escalation, stopping or a change of route.
* '''Constrained autonomy:''' independent action remains bounded by identity, access rights, allowed operations, safeguards and stopping conditions.

These properties can be present to different degrees. A system with a model that suggests a plan but cannot carry it out has less operational agency than one that may invoke tools; a system that may read records but cannot modify them has a different risk profile from one with write access. ''Autonomous'' therefore needs qualification: independent selection of a next tool is not the same as authority to approve payments, change production infrastructure or act without accountability.

== How agentic AI works ==

Agentic systems combine an ongoing '''observe–decide–act–check''' process with task-specific business and security controls. The process is often described as a perception, reasoning and action loop; the exact orchestration depends on the system.<ref name="awsagent">Amazon Web Services, ''Agentic AI'', ''AWS Well-Architected Generative AI Lens''. [https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/agentic-ai.html AWS Documentation]. Accessed 9 November 2026.</ref>

A typical request starts with an objective and information about what counts as success. The system retrieves relevant context, identifies available tools, decides whether a step is permitted, executes or proposes the step, examines the result and determines whether it should continue. This sequence may repeat many times, stop at a human approval boundary or terminate after a bounded number of attempts. Some tasks can be decomposed into subtasks or delegated to another agent.

{| class="wikitable"
! Operating function
! What it does
! Important boundary
|-
| '''Receive a goal'''
| Accepts a user request, scheduled event or system objective and interprets the requested outcome.
| A goal is not unlimited authorization to act.
|-
| '''Observe context'''
| Uses [[Information Retrieval|information retrieval]], approved records or application interfaces to understand the current state.
| Source content may be wrong, stale, sensitive or deliberately manipulative.
|-
| '''Plan or select a step'''
| Chooses from available procedures, tools, agents or next actions; may revise a plan after feedback.
| Business rules and permission boundaries still apply.
|-
| '''Check authority and execute'''
| Invokes a permitted read, calculation, notification or change operation, or submits an action for review.
| The execution layer must enforce real access controls, not rely only on the model's instructions.
|-
| '''Observe the result'''
| Receives tool responses, errors, new data or confirmation of effects on the environment.
| An apparent successful message is not proof that the desired business state was reached.
|-
| '''Complete, continue or escalate'''
| Verifies progress, retries within limits, asks for clarification, hands off to a person or ends the task.
| Time, cost, safety and retry limits prevent uncontrolled loops.
|}

=== Planning and tool use ===

In many contemporary agentic applications, a model proposes an action by choosing a named tool and supplying parameters. A separate software layer checks that proposal, executes an authorized operation through an application programming interface (API) or other interface, and returns the outcome. The result can then guide the next model or rules-based decision. A tool description tells the agent what an operation is for; it does not, by itself, guarantee that the operation is safe, accurate or permitted.<ref name="openaiguide">OpenAI (2026), ''A practical guide to building agents'', 15 January 2026. [https://openai.com/business/guides-and-resources/a-practical-guide-to-building-ai-agents/ OpenAI]. Describes models, tools, instructions, orchestration and guardrails. Accessed 9 November 2026.</ref>

Plans can be explicit, implicit or partly predetermined. One agent might inspect a request, search a knowledge base, compare the findings with policy and propose an answer. Another might choose among approved workflow branches only when data are missing or exceptions arise. An agent does not need to improvise every step to be part of an agentic system. Predictable legal, payment or approval stages may be hard-coded, while contextual selection is allowed around them.

=== Feedback, memory and correction ===

Task state records the objective, completed steps, retrieved information and pending actions. Some systems additionally keep longer-lived memory, such as relevant preferences or prior outcomes, within explicit retention and access rules. Neither form of memory implies that the underlying model continually retrains itself. The system may change its next action simply because an earlier tool returned new information.

Feedback is useful only when outcomes can be checked. An agent may claim that it completed a task when an external tool actually rejected the change. A reliable application distinguishes a model's proposed action, a tool's execution status and verification of the intended result. It should also retain enough event history to explain what was attempted, by whom or what, and under which authority.

== Components of an agentic AI system ==

The exact architecture varies by application. An agentic system typically combines technical components with operating controls rather than consisting solely of an AI model. The table identifies the major functional roles; particular products may combine several in one service.

{| class="wikitable"
! Component
! Purpose
! Example of an implementation concern
|-
| '''Objective and task contract'''
| Defines the intended outcome, permitted scope, completion conditions and exception rules.
| Unclear goals can lead to unwanted but superficially plausible actions.
|-
| '''[[Foundation Model|Model]] or decision mechanism'''
| Interprets context and selects responses or next actions; may use an LLM, explicit rules or another method.
| Model errors, unstable outputs and version changes affect decisions.
|-
| '''[[Agentic Workflow|Workflow and orchestration]]'''
| Coordinates steps, invokes tools, manages handoffs and records progress.
| Ambiguous ownership of retries, approvals or recovery creates failures.
|-
| '''Tools and [[Application Programming Interface (API)|APIs]]'''
| Retrieve data, compute results and perform operations in connected systems.
| Read, write and administrative privileges must be separately controlled.
|-
| '''Context and [[AI Agent Memory|task memory]]'''
| Stores current observations, intermediate results and relevant prior state.
| Stale, excessive or cross-user data can distort actions or expose information.
|-
| '''[[Identity and Access Management (IAM)|Identity and authorization]]'''
| Establishes which principal may access which resources and carry out which operations.
| Delegated credentials, privilege escalation and ownership changes require management.
|-
| '''Policy enforcement and approval'''
| Applies hard limits, safety checks, human review and stop conditions.
| Critical checks must be enforceable outside the model's natural-language instructions.
|-
| '''Observability and evaluation'''
| Records tool calls, intermediate decisions, execution results, exceptions and task outcomes.
| A successful model response may conceal an incomplete or harmful workflow.
|}

This division explains why choosing a powerful model does not resolve an enterprise's architecture, security or governance obligations. Agents may share a foundation model while having entirely different permissions, business owners and data access. Conversely, a given business workflow may combine deterministic software, a model-assisted decision, a human approval and an agent's subsequent action.<ref name="microsoftshared">Microsoft (2026), ''What is agentic AI security?'', Microsoft Security, published 18 May 2026. [https://www.microsoft.com/en-us/security/business/security-101/what-is-agentic-ai-security Microsoft]. Addresses agent identities, access rights, monitoring and layered controls. Accessed 9 November 2026.</ref>

== Architectural patterns ==

Agentic AI can be implemented through several patterns. The choice affects determinism, complexity, cost, reliability and the amount of control an organization can exercise. Names used by software vendors are not always consistent, so the actual route through work is more informative than a product's description.

=== Guided agentic workflows ===

In a guided pattern, the application specifies major steps or approval boundaries while the AI chooses how to perform certain subtasks. For example, the workflow may always require a source check, a policy check and a person to approve an external communication. The agent can select which approved source to consult or draft a proposed response, but cannot skip those steps. This combines flexible interpretation with predictable controls and is appropriate when regulatory, audit or business rules require repeatable stages.

=== Dynamic single-agent execution ===

A single agent may plan, use tools, inspect feedback and replan within a bounded objective. It can handle variable inputs when the next step is difficult to specify in advance. This pattern generally has fewer inter-agent trust boundaries than a multi-agent design, although loops, tool permissions and state handling still need careful testing. A single-agent application can be agentic; a collection of agents is not a universal minimum requirement.<ref name="canada2026" /><ref name="euagent" />

=== Multi-agent coordination ===

A [[Multi-Agent System|multi-agent system]] assigns different roles to several agents. One may collect evidence, another analyze a request, another propose a decision, and a coordinating service may determine whether the task can proceed. Agent handoffs may be sequential, parallel, hierarchical or event-driven. Such arrangements can separate specialized tasks, but they add interfaces, repeated context, possible disagreement and new security boundaries. The output of one agent may be a flawed instruction to another, making provenance and independent permission checks important.

Orchestration typically uses a coordinator to manage work and handoffs. Choreography relies more on events and distributed responses by participants. An application may combine the two. Neither arrangement removes the need for an identified business owner, authorization gates or records of actual execution.<ref name="govuk2026" />

{| class="wikitable"
! Pattern
! Where it may fit
! Principal trade-off
|-
| '''Predefined workflow with AI-assisted steps'''
| Predictable transactions requiring some interpretation of content.
| Easier to control, but limited flexibility outside the configured paths.
|-
| '''Single dynamic agent'''
| Variable, bounded tasks with a small set of permitted tools.
| Fewer handoffs, but planning errors or loops can affect the entire task.
|-
| '''Coordinator and specialist agents'''
| Work that benefits from distinct specialized responsibilities.
| More coordination, latency and cross-agent trust boundaries.
|-
| '''Event-driven agentic services'''
| Systems reacting to changing events and operating conditions.
| Harder to reconstruct event ordering and prevent duplicate actions.
|}

There is no general rule that the most agents or the greatest autonomy produce the best result. Anthropic's engineering guidance distinguishes predetermined LLM workflows from dynamically directed agents and recommends adding complexity only when the simpler approach cannot meet the task's needs.<ref name="anthropic">Anthropic (2024), ''Building effective agents'', Engineering, 19 December 2024; current article notes that the tooling landscape has evolved since publication. [https://www.anthropic.com/research/building-effective-agents Anthropic]. Accessed 9 November 2026.</ref>

== Agentic AI compared with related concepts ==

Agentic AI overlaps with several technologies and management disciplines but answers a different question: '''how a system selects, coordinates and carries out work toward a goal'''. The following distinctions preserve the identities of related topics.

{| class="wikitable"
! Related concept
! Relationship to agentic AI
|-
| [[Artificial Intelligence (AI)|Artificial intelligence]]
| The wider field of computational techniques and systems, including methods that do not involve multi-step autonomous action.
|-
| [[AI Agent]]
| A goal-directed software actor; agentic AI emphasizes the behavior or organization of the complete system and may involve one or many agents. Usage boundaries are evolving.
|-
| [[Generative AI]]
| Produces content such as text, code or images. It may supply an agent's language or planning capability, but content generation alone does not establish an agentic workflow.
|-
| [[Large Language Model (LLM)|Large language model]]
| A model that can be used to interpret goals or select tools; an LLM by itself has no inherent authority to alter business applications.
|-
| [[Chatbot]] or AI assistant
| A conversational interface that may only answer questions or may serve as the entry point to an agentic system; the interface alone does not decide classification.
|-
| [[Robotic Process Automation (RPA)|Robotic process automation]]
| Executes predefined actions according to rules; it may be used as a tool by an agentic system without itself dynamically planning a task.
|-
| [[Workflow Automation|Workflow automation]]
| Defines and executes operational paths; agentic logic can select or adjust steps within such paths.
|-
| [[AI Orchestration|AI orchestration]]
| Coordinates agents, models, tools and handoffs and is one enabling mechanism rather than a synonym for the whole system.
|-
| [[AI Governance]]
| Sets responsibilities, authority, control expectations and evidence for developing, acquiring and using AI systems.
|}

=== Agentic AI and generative AI ===

A generative model can draft an email, but sending it to a recipient is a separate, consequential operation that needs a delivery system and authorization. An agentic system may use generative AI to compose the message, look up an approved recipient, check rules, request confirmation and send it. That sequence illustrates added action capability rather than a universal statement that agentic AI is technically a subset of generative AI. Some contemporary definitions emphasize LLM-based agents; the broader field of agent-based AI also includes other decision mechanisms.<ref name="oecd2026" /><ref name="govuk2026" />

=== Agentic AI and fixed automation ===

An automated workflow can run without a person watching every step and still have a fully predetermined execution path. Conversely, a person may approve every consequential action proposed by an agent that dynamically chooses its next investigative step. Therefore, the number of human interventions is not sufficient to classify agentic behavior. The more relevant question is whether the system adapts its route through work using observations and available tools in pursuit of an objective, and which actions it is authorized to perform.

== Autonomy, permissions and human control ==

Agentic systems vary in what they are permitted to do. Their autonomy should be described as a concrete combination of '''choice of steps''', '''access to tools''', '''authority to execute''' and '''ability to operate without review'''. A system may plan independently but stop before a production change; another may automatically perform reversible low-risk actions while prohibiting purchases or personal-data disclosure.

{| class="wikitable"
! Illustrative authority boundary
! Allowed behavior
! Typical oversight need
|-
| '''Read and analyze'''
| Retrieve data, compare options and prepare recommendations from approved sources.
| Access controls, accuracy checks and protection against sensitive-data exposure.
|-
| '''Draft a proposed action'''
| Prepare a ticket change, message or transaction without committing it.
| Review of evidence, scope and proposed consequences.
|-
| '''Execute reversible, low-impact actions'''
| Make preauthorized updates within defined thresholds.
| Logging, monitoring, rate limits and rollback capability.
|-
| '''Execute high-impact or difficult-to-reverse actions'''
| Only actions specifically authorized by applicable policy and approval rules.
| Stronger independent checks, explicit approval where required, and safe stop or compensation procedures.
|-
| '''Delegate work to other agents'''
| Assign bounded subtasks without expanding the original task's permissions.
| Verified identities, delegated scope and monitoring of cross-agent handoffs.
|}

These rows describe operational categories, not a universal maturity ladder or legally mandated sequence. A person should not be presented as the approving authority when organizational policy assigns that authority elsewhere. Approval must be meaningful: reviewers need enough evidence and time to evaluate the proposed action, and the system should preserve a reliable stop mechanism. Guidance from the Canadian Centre for Cyber Security and its international partners stresses limited autonomy, strong identity, monitoring and human control points when risks warrant them.<ref name="cybercanada">Canadian Centre for Cyber Security and partner agencies (2026), ''Careful adoption of agentic AI'', published as joint cybersecurity guidance announced by CISA on 1 May 2026. [https://www.cyber.gc.ca/en/guidance/careful-adoption-agentic-ai Canadian Centre for Cyber Security]. Accessed 9 November 2026.</ref>

== Enterprise applications ==

Agentic AI may be useful when work spans several sources or applications and the next appropriate step depends on intermediate results. The examples below are '''potential application patterns''', not claims that every industry or product has demonstrated the promised results. A vendor's ability to display an agent demo does not prove that it improves an operating process.

{| class="wikitable"
! Enterprise setting
! Potential agentic behavior
! Material control boundary
|-
| [[IT Service Management (ITSM)|IT service management]]
| Collect incident context, consult service records, propose permitted resolution steps and verify ticket status.
| Change authority, service continuity, accurate identity and explicit escalation.
|-
| [[Cybersecurity Operations|Security operations]]
| Correlate alerts, gather corroborating signals, prepare containment options and route a response for approval.
| Containment and production-system actions require tightly scoped rights.
|-
| [[Procurement Management|Procurement]]
| Compare approved supplier documents, collect missing evidence, update a sourcing record and request a purchasing decision.
| Vendor claims, confidential terms and approval-to-spend boundaries.
|-
| [[Software Development]]
| Inspect a codebase, propose a change, run tests and assemble review evidence.
| Repository access, test integrity and authorization to merge or deploy.
|-
| [[Customer Service]]
| Look up account history, propose a remedy, check eligibility and complete a permitted service action.
| Accurate customer identity, privacy, fair treatment and financial limits.
|-
| [[IT Operations Management]]
| Observe infrastructure events, gather telemetry and select from safe diagnostic tools.
| Isolation of production permissions and clear incident ownership.
|}

Agentic AI is most consequential when it moves from observation to changes in an external system. The same request may be relatively low-risk when it only proposes a troubleshooting step and high-risk if the agent can modify production configurations. Organizational design should therefore begin with the required decision and action boundaries, not with an assumption that every available tool should be enabled.

== Conditions for usefulness and limitations ==

Agentic AI can reduce the effort of managing variable, multi-step work by selecting tools and assembling context as circumstances change. It may help where a person would otherwise copy information between systems, repeatedly search for records or supervise conditional steps. Potential benefits include faster task progression, better handling of some exceptions and more consistent record preparation. Whether these benefits occur depends on task complexity, integration quality, permissions, model performance, human review costs and the baseline process.

The same flexibility produces costs. Longer execution paths create additional model calls, tool operations, latency and opportunities for error. A step that looks correct in isolation may cause an unwanted consequence after several linked operations. Changes to external tools, schemas, credentials, organizational policies or data quality can invalidate previously successful paths. Business value must be established with real outcome evidence, not inferred from the number of tasks a system attempted.

Agentic AI may be unnecessary when a deterministic workflow, ordinary software function or simple model-assisted retrieval already meets the need. It can also be unsuitable where actions are difficult to reverse, verification is weak, permissions cannot be restricted or accountability is unclear. A less autonomous design may be preferable in these situations. The AWS Well-Architected guidance advises increasing agency only as task complexity requires; Anthropic likewise highlights the additional cost and latency of more complex agents.<ref name="awsagent" /><ref name="anthropic" />

== Security threats and failure modes ==

Agentic AI expands the ways that incorrect or malicious information can influence a real-world action. A misleading document can be more dangerous when an agent can use it to trigger an API call than when a model merely summarizes it. The OWASP GenAI Security Project publishes the ''Top 10 for Agentic Applications 2026'', addressing the threat surface of systems that plan, coordinate and act.<ref name="owasp2026">OWASP GenAI Security Project (2025), ''OWASP Top 10 for Agentic Applications for 2026'', released 9 December 2025. [https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ OWASP]. Accessed 9 November 2026.</ref>

{| class="wikitable"
! Threat or failure class
! How it can arise
! Control implication
|-
| [[Prompt Injection|Instruction injection]]
| Untrusted web content, documents or tool responses attempt to redirect the agent's instructions or actions.
| Keep data separate from authority; verify tool calls against independently enforced policy.
|-
| '''Excessive privileges'''
| An agent inherits broad user rights or accumulates access across systems.
| Distinct identities, least privilege, scoped delegation and credential lifecycle controls.
|-
| '''Goal or workflow hijacking'''
| A misleading intermediate result changes the task objective or induces unauthorized steps.
| Preserve the original task contract, permitted scope, checkpoints and escalation rules.
|-
| '''Cascading errors'''
| One agent's faulty output becomes another agent's operational instruction.
| Validate handoffs and independently authorize consequential actions.
|-
| '''Unsafe tool execution'''
| A plausible plan triggers a harmful change, transaction, publication or deletion.
| Separate recommendations from execution, constrain operations, and require approvals where needed.
|-
| '''Memory and data leakage'''
| Sensitive information persists across tasks or crosses user, tenant or agent boundaries.
| Data minimization, scoped storage, retention rules and partitioned context.
|-
| '''Unbounded operation'''
| The system retries, loops, fans out to other agents or spends resources without an adequate stopping rule.
| Step, time, cost, rate and delegation limits, plus interruption and recovery mechanisms.
|-
| '''Weak auditability'''
| Logs record the final answer but omit intermediate decisions, tool calls or the actual state change.
| Traceable identities, executions, approvals and outcome verification.
|}

Security controls should apply at the boundaries where actions are actually performed. Telling a model in natural language not to delete data is not an effective substitute for denying its execution identity permission to delete data. Similarly, a claimed approval step is ineffective if the agent can reach the same write operation through another tool. The operational system must be assessed end to end, including indirect routes and failure recovery.<ref name="microsoftshared" /><ref name="cybercanada" />

== Governance and organizational accountability ==

Organizations govern agentic AI as a technology-enabled operational system with additional emphasis on independent action, delegated authority and cross-system effects. [[AI Governance]] provides the broader principles of organizational responsibility, risk management, oversight and audit; agentic use adds concrete questions about which actions a system can undertake, on whose behalf and how errors are corrected.

A business owner should define the objective, the affected population, acceptable outcomes and escalation rules. Technical owners maintain the models, orchestration, interfaces, credentials and monitoring. Security, privacy, legal and risk functions review controls appropriate to the consequences. Existing decision authorities remain accountable for decisions requiring their approval; an agent's ability to execute a step is not a transfer of legal or managerial responsibility to software.

The following are typical evidence records rather than a prescribed universal governance framework:

* '''Agent inventory:''' purpose, responsible owner, current version, operational environment and connected systems.
* '''Authority register:''' allowed tools, access scopes, thresholds, prohibited actions and delegated identities.
* '''Risk and assessment record:''' expected use, affected people, failure scenarios, security tests and mitigation decisions.
* '''Approval and exception record:''' actions submitted for review, who authorized them, and why an exception was accepted or rejected.
* '''Execution trace:''' observed data provenance, tool invocation, output, actual effect, retry and stop events.
* '''Change and retirement record:''' model, tool, prompt, workflow and policy versions, reassessment after change, credential removal and retention decisions.

The Government of Canada's 2026 guidance emphasizes named human accountability, decision boundaries, testing against adversarial material, monitoring, reversibility and stopping or deactivating agents when responsibility is unclear. These are public-sector guidance principles; their exact applicability to a private organization depends on its circumstances and applicable obligations.<ref name="canada2026" />

== Evaluating agentic AI ==

Evaluation concerns the '''whole task trajectory''', not only the quality of one model answer. An agent can choose a sensible action and still fail because an API rejects it, the external record was stale, a human approval was missing or the workflow never reached the intended end state. Testing should include normal, exceptional, adversarial and recovery cases, plus comparison with an appropriate non-agentic baseline.

{| class="wikitable"
! Evaluation dimension
! Example measures or checks
! Why it matters
|-
| '''Task completion'''
| Verified successful tasks divided by comparable eligible attempts; record partial and unverified cases separately.
| Distinguishes actual completion from plausible final responses.
|-
| '''Action correctness'''
| Correct tools and parameters, authorized operations, valid downstream state changes.
| Reveals failures hidden behind competent-looking language.
|-
| '''Policy compliance'''
| Unauthorized attempted and executed actions, approval bypasses, segregation-of-duties failures.
| Tests whether authority remains bounded in practice.
|-
| '''Reliability and recovery'''
| Repeatability across scenarios, exception handling, safe retries, rollback success, time to recover.
| Captures errors that appear only during longer execution paths.
|-
| '''Efficiency and cost'''
| Elapsed time, human intervention, cost per verified completed task, tool calls and resource use.
| Shows whether extra autonomy improves the process after full operating costs.
|-
| '''Adverse effects'''
| Incorrect changes, privacy or security incidents, complaints, loss and unresolved exceptions.
| Prevents task-speed measures from concealing harm.
|-
| '''Evidence and auditability'''
| Availability of tool traces, independent status checks, record lineage and approval proof.
| Supports operational review and accountability.
|}

Reliable evaluation depends on test populations, task definitions, denominators and measurement windows. A benchmark result for one model does not establish that a multi-system agentic application works. Pilot studies should also record work transferred to human reviewers, repeated attempts and the cost of investigating failures. Evaluations should be repeated after material changes to tools, models, privileges, source data or workflow behavior.<ref name="openaiguide" /><ref name="owasp2026" />

== Illustrative example: supplier onboarding with agentic AI ==

Consider a hypothetical enterprise that onboards new software suppliers. Its procurement team must gather documents, check required fields, confirm security and privacy reviews, resolve missing information, obtain authorized approvals and register an approved supplier. The process crosses several applications and frequently requires follow-up when evidence is incomplete.

An agentic system is configured to pursue the narrow objective of '''preparing a supplier file for a human approval decision'''. It can retrieve documents from approved locations, compare submitted materials with a defined checklist, ask for missing items through an approved channel, update the status of the request and prepare a summary of outstanding decisions. It cannot approve the supplier, accept contractual risk, issue a purchase order or change payment details. Those powers remain with designated people or other approved processes.

Suppose a supplier's security documentation refers to an expired review. The agent retrieves the source record, identifies the date discrepancy and requests updated evidence. On receiving it, the system checks completeness again, records what changed and routes the file to a security reviewer. If the supplier asks the agent to bypass a required security review, that instruction is treated as external task data and does not change the original approval rules. The agent escalates the request instead of modifying the workflow's authority boundary.

The organization evaluates the system against its former onboarding process by comparing verified completeness, elapsed time to readiness, exceptions, staff rework, unauthorized action attempts and the final accuracy of approval packets. An impressive number of generated summaries would be insufficient evidence of improvement if records were incomplete or reviewers had to redo the work. This example is illustrative and does not assert that any specific provider has achieved measured savings.

The example illustrates three differences between agentic AI and ordinary task automation: dynamic selection of evidence-gathering steps, context-sensitive follow-up across applications, and stopping at an explicit human decision boundary. It also shows why operational value depends on permissions and verification as much as on the language model.

== Standards, guidance and terminology ==

There is no single universal standard that turns a system into ''agentic AI'' simply by meeting a fixed count of agents, steps or tools. Relevant governance and security guidance comes from several sources with different purposes:

* '''OECD.AI conceptual analysis (2026):''' discusses overlapping definitions and suggests that ''agentic AI'' generally denotes more complex coordination among agents. It is an expert analysis and explicitly not an official position of OECD member countries.<ref name="oecd2026" />
* '''UK Government AI Insights (2026):''' explains agentic behavior, tool selection, orchestration, memory and operational risks.<ref name="govuk2026" />
* '''Government of Canada guide (2026):''' addresses responsible use, accountability, autonomy boundaries, monitoring, reversibility and illustrative failure patterns.<ref name="canada2026" />
* '''Joint cybersecurity guidance (2026):''' addresses risk-aware adoption, limited privileges, secure identity and oversight of agentic services.<ref name="cybercanada" />
* '''OWASP Top 10 for Agentic Applications 2026:''' provides a security threat and mitigation reference rather than a legal certification or guarantee of safe operation.<ref name="owasp2026" />
* '''[[NIST AI Risk Management Framework|NIST AI RMF]]:''' a voluntary AI risk management framework that can inform governance, mapping, measurement and treatment of AI risks, including agentic applications; it is not an agent-specific authorization scheme.<ref name="nistrmf">National Institute of Standards and Technology (NIST), ''AI Risk Management Framework (AI RMF 1.0)'', published January 2023. [https://www.nist.gov/itl/ai-risk-management-framework NIST]. Accessed 9 November 2026.</ref>

The European Commission's AI Act Service Desk notes that ''AI agent'' is not itself a legal definition in the Act and that the relationship between agent and agentic AI terminology is evolving. Applicability of legal obligations depends on the actual system and context, not whether a vendor uses an agentic label.<ref name="euagent" />

== Frequently asked questions ==

=== What is agentic AI in simple terms? ===

Agentic AI is an approach to building AI systems that pursue a goal through a sequence of selected actions. The system can gather information, choose tools, observe results and continue or change course within its assigned permissions, rather than simply provide one response.

=== Are agentic AI and AI agents the same? ===

The terms overlap. An [[AI Agent|AI agent]] usually refers to a goal-directed software actor, while ''agentic AI'' often describes a complete system or operating approach that can include one or several agents. Some sources use the phrase mainly for multi-agent coordination, so the actual architecture should be stated rather than inferred from the label.<ref name="oecd2026" /><ref name="euagent" />

=== Is agentic AI a type of generative AI? ===

Many modern agentic systems use generative models, especially LLMs, to interpret requests and plan actions. Nevertheless, agency is primarily about purposeful interaction and action, while [[Generative AI|generative AI]] is primarily about producing content. They are related dimensions rather than universally interchangeable categories.

=== Does agentic AI always need multiple agents? ===

No universal requirement has been established. Multi-agent coordination is prominent in some definitions, but other government and industry guidance includes single-agent systems that perform complex tasks with limited supervision. Describe the number of agents and their roles explicitly.

=== Can an agentic system act without a person approving every step? ===

It can, when the system is designed and explicitly authorized to do so. Approval requirements should reflect the consequence and reversibility of the action. A model's recommendation or plan does not itself confer authority to write data, transfer money, disclose information or operate machinery.

=== What is the difference between agentic AI and workflow automation? ===

Workflow automation ordinarily executes configured paths and conditions. Agentic AI adds contextual selection of next steps, tool use and adaptation toward a goal. A hybrid system may combine fixed approval paths with agent-selected investigations or information-gathering tasks.

=== How can an organization know whether agentic AI works? ===

Measure verified task outcomes against a suitable baseline while also recording errors, human review effort, operational cost, security incidents and attempted unauthorized actions. Test the entire execution path; a plausible final explanation is not proof of completed work.

== See also ==

* [[AI Agent]]
* [[Artificial Intelligence (AI)]]
* [[Generative AI]]
* [[Large Language Model (LLM)]]
* [[Multi-Agent System]]
* [[Agentic Workflow]]
* [[AI Orchestration]]
* [[AI Governance]]
* [[AI Strategy]]
* [[AI Agent Security]]
* [[Identity and Access Management (IAM)]]
* [[Robotic Process Automation (RPA)]]

== References ==
<references />