AI & TECHNOLOGY / PRACTICAL GUIDE
AI Agents Explained: Tools, Memory and Autonomy
An AI agent is a system built to pursue a goal across multiple steps, usually by choosing among tools, drawing on stored context, and adjusting based on what happens after each action. The term covers a wide range of designs, so the useful question is never "is this an agent" — it's "what can this specific system actually read, write, spend and delete, and who checks it before it does."
In this guide
- Model, workflow or agent — which one are you actually using
- Draw the permission map before you turn one loose
- Three permission maps, filled in
- A human-checkpoint workflow
- Memory means several different things
- A named example, for orientation only
- Why an audit trail matters
- What to watch while it runs unattended
- Build the undo before you need it
- What to do next
- Sources and further reading
Model, workflow or agent — which one are you actually using
A plain model produces one output for one input, like a chatbot answering a single question. A workflow chains predetermined steps together — do A, then B, then C, always in that order. An agent adds a layer on top: it can choose which action to take next based on what the last step returned, within some goal it was given.
Most products marketed as "AI agents" combine all three at different points, which is exactly why the label alone tells you very little about what the system can actually do to your data, your money or your inbox.
Draw the permission map before you turn one loose
The useful question for any agent isn't how capable it is — it's what it's actually allowed to touch. Write this down before you grant the access, not after something goes wrong.
| Capability | What it lets the agent do | Risk if it goes wrong |
|---|---|---|
| Read | Search the web, read files, query a database | Usually low — information exposure if the source is sensitive |
| Write | Draft documents, edit files, update records | Medium — wrong or misleading content saved as if it were reviewed |
| Execute code | Run scripts, call other software or external APIs | High — can chain automatically into any capability below |
| Spend | Make purchases, book services, move money | High — real financial loss, often hard to reverse |
| Publish | Post publicly, send emails, message customers | High — reputational damage a private mistake never causes |
| Delete | Remove files, records or accounts | High — often irreversible without a separate backup |
Three permission maps, filled in
Three examples of where the line usually belongs for common agent types:
- Calendar agent: Reads your calendar and proposes events, holds and reschedules. Does not send invites, accept on your behalf or cancel a meeting without a tap from you.
- Coding agent: Edits files on its own branch and runs the test suite. Does not merge to main, deploy, touch credentials or change who has access to the repository.
- Shopping agent: Compares prices and fills a cart. Does not pay without approval, and carries a hard cap, say $50 per order and $200 per month, that it cannot raise on its own.
A human-checkpoint workflow
- A person sets the goal: State the objective and the boundaries in advance, not the exact steps — that part is the agent's job.
- The agent plans its steps: It breaks the goal into an ordered set of actions, using whatever tools it has access to.
- It proposes the next action: Before executing anything above a defined risk level, the agent states what it is about to do and why.
- A checkpoint gates it: Low-risk, reversible steps can run automatically. Spending, publishing, deleting and anything touching sensitive data wait for a human "yes," every time.
- It executes and logs: Every action taken is recorded — what happened, using which tool, with what result — not just the final summary.
- A person audits the log: Review what actually ran, not just what the agent reported running, since the two can differ.
Memory means several different things
"Memory" in an agent can mean the current conversation, a database of past interactions, or a standing profile of you built up over time. Each has a different lifespan and a different privacy exposure, so ask directly: what is stored, for how long, and who else — including the provider — can access it.
A named example, for orientation only
Features described as "agentic," "computer use" or an autonomous mode now appear across tools such as Claude, ChatGPT and Gemini — named here only as examples of the category, not as an endorsement or a ranking. What actually matters is never the brand name; it's the permission map you build for that specific feature, in that specific product, at the access level you personally granted it.
Why an audit trail matters
An agent that can act without a human in the loop needs the same record-keeping a person in that role would be expected to keep — what was done, when, under what authority, and what the outcome was. Without that record, "the agent did it" becomes an explanation nobody can actually check.
Worth remembering: Give the least access needed for the task, not the most convenient. An agent with read-only calendar access can be useful; the same agent with standing permission to spend on your card needs a hard dollar limit and a human approval step, every single time.
What to watch while it runs unattended
A log is only useful if someone reads it, and nobody reads everything. Log broadly, then decide in advance which signals get a human's attention.
- Every action, timestamped: Which tool was called, with what inputs, what came back, and how long it took.
- Running totals: Money spent, messages sent, files changed and records deleted, against the budget you set for the session.
- Anomaly signals: Three failed attempts at the same step, activity at 3 a.m. when the agent normally works business hours, or ten times the usual volume in an hour.
- Alerts on high-risk actions: Anything in the spend, publish or delete rows should notify a person the moment it fires, not turn up in a weekly summary.
Build the undo before you need it
A checkpoint stops a bad action before it happens; rollback covers the ones that got through. Set these up before the agent runs, since none can be added afterward.
- Version before write: Snapshot or back up any file or record before the agent changes it, so the previous state is one click away.
- Draft before publish: Emails, posts and messages land in a staging or drafts state first. Nothing leaves without a person seeing the final version.
- Cancelable spend: Prefer purchases with a cancellation window or refund policy, and hold orders for an hour before they finalize where the vendor allows it.
- Soft delete, not hard delete: Move items to a recoverable bin with a retention period of days or weeks. Permanent deletion is a separate, human-approved step.
What to do next
- Pick one agent or automated tool you already use and write down, honestly, everything it can read, write, spend, publish and delete.
- Add an explicit human checkpoint in front of anything on that list marked spend, publish or delete.
- Check what it stores as memory and for how long, and delete anything you don't actually need it to remember.
Sources and further reading
New research into practice: AI Productivity: Start the Clock Before the Prompt.