# AI Agent

AI Glossary · Agents & Automation
Canonical URL: https://aisat.uk/glossary/ai-agent
Author: Lucy Gilmore, Assistant General Counsel, Product, Privacy & AI at Sprinklr | Practical Privacy, Product & AI Governance & Defensible Risk Decisions (https://www.linkedin.com/in/lucy-gilmore/)
Breadcrumb: [Glossary](https://aisat.uk/glossary) > [Agents](https://aisat.uk/glossary?category=agents) > AI Agent

## TL;DR

> **An AI agent** is a software unit powered by a language model that can perceive inputs, maintain state across turns, decide which actions to take, and execute tools to achieve a specific objective. Unlike a passive chatbot, an AI agent interacts directly with external systems and environments.

## How AI Agent works in practice

At runtime, an AI agent operates inside an execution harness that manages its system instructions, conversation history, tool definitions, and stopping conditions. When triggered by a user message, a webhook, or a scheduled cron job, the model evaluates the current context and decides whether to emit a final response or generate a structured tool call.

If the model calls a tool, such as running a SQL query, searching a vector index, or executing Python in a sandboxed container, the harness intercepts the request, validates the arguments against a schema, runs the function, and appends the output back into the agent's working context. The agent then inspects the observation and chooses its next action, repeating this reason-and-act cycle until the goal is complete or a step budget is exhausted.

For example, an Edinburgh fintech deploys a customer-onboarding KYB (Know Your Business) agent. When a small business applies for a merchant account, the agent queries Companies House APIs, pulls ultimate beneficial owner filings, cross-references sanctions lists, flags discrepancies in uploaded bank statements, and posts a structured risk summary into Slack for the compliance officer.

## Why it matters and trade-offs

AI agents bridge the gap between natural-language intelligence and legacy enterprise software. Because an agent can read unstructured documents and call REST APIs or MCP servers, teams can automate cross-system workflows without waiting quarters for core banking or ERP vendors to ship native integrations.

However, deploying an AI agent into production requires treating the model as an untrusted insider with API credentials. Without strict least-privilege scoping, execution timeouts, and loop detection, a confused or prompt-injected agent can burn hundreds of pounds in API tokens in minutes or corrupt live records. High-consequence mutations, such as wiring funds or deleting customer data, must always sit behind deterministic policy checks or human-in-the-loop confirmation.

## LinkedIn explainer post

- [Lucy Gilmore on AI Agent (Agents)](https://www.linkedin.com/feed/update/urn:li:share:7518583721822953473/)

## Related AI concepts

- [Agentic AI](https://aisat.uk/glossary/agentic-ai): Agentic AI refers to artificial intelligence systems engineered to pursue multi-step objectives with bounded autonomy by decomposing goals, invoking external tools, inspecting intermediate results and adapting plans under defined governance controls.
- [Model Context Protocol (MCP)](https://aisat.uk/glossary/model-context-protocol): Model Context Protocol (MCP) is an open JSON-RPC standard introduced by Anthropic in November 2024 and donated to the Linux Foundation's Agentic AI Foundation in December 2025 that standardises how AI models and agents connect to external data and tools.
- [Function Calling (Tool Use)](https://aisat.uk/glossary/function-calling): Function Calling (Tool Use) is a model capability in which a language model inspects declared tool schemas and emits a structured JSON invocation naming an external function and arguments for the host runtime to execute.
- [Guardrails](https://aisat.uk/glossary/guardrails): Guardrails are programmable validation layers placed on the input and output paths of an AI application to detect prompt injections, redact personally identifiable information, verify citations and block policy-violating completions in real time.