What Is Agentic AI?

How it works#

An agentic system typically combines six capabilities:

1. Goal interpretation: The system converts a natural-language request or event into an objective. For example, “investigate this suspicious login” may become a set of investigation tasks.
2. Planning: The agent determines which steps could achieve the objective. The plan may be created all at once or revised as new information appears.
3. Tool use: The agent calls approved tools such as ticketing systems, cloud APIs, search services, databases, or security platforms.
4. State and context: The system tracks relevant conversation history, retrieved data, completed steps, and tool results. Some implementations retain state across sessions.
5. Evaluation: The agent checks whether a result is complete, valid, or sufficient. It may identify missing information or retry a failed action.
6. Action: The system produces an output or changes an external system. Actions can include creating a ticket, updating a record, sending a message, or modifying infrastructure.

A simple agent loop looks like this:

receive goal
while goal is not complete:
    inspect context and available tools
    select the next action
    request approval if the action is sensitive
    call the tool
    validate the result
    update state
return result and audit trail

The model does not automatically gain access to every system. Developers or administrators connect tools and define what the agent can call. That boundary is important: the practical risk of an agent depends heavily on its identity, permissions, data sources, execution environment, and ability to affect external systems.

Technical Notes

A production implementation might expose tools through structured functions rather than allowing unrestricted command execution:

{
  "name": "create_ticket",
  "description": "Create an incident ticket in the service desk",
  "parameters": {
    "type": "object",
    "properties": {
      "title": {"type": "string"},
      "severity": {"type": "string", "enum": ["low", "medium", "high"]},
      "summary": {"type": "string"}
    },
    "required": ["title", "severity", "summary"]
  }
}

A safer deployment should also define controls such as:

identity: dedicated non-human service account
permissions: least privilege, scoped by system and action
approval: required for deletion, production changes, or external messaging
logging: prompts, tool calls, results, approvals, and failures
limits: maximum steps, execution time, spend, and data volume

For systems that store or retrieve sensitive credentials, teams should also define how encryption keys are managed. A dedicated key management service can help separate key administration from the agent’s application permissions.

These controls reduce the impact of incorrect reasoning, prompt injection, compromised credentials, and unexpected tool behavior. They do not make an agent infallible. An agent can still select an inappropriate action, misunderstand untrusted content, expose sensitive data, or repeat a flawed plan.

When you’ll encounter it#

You may already be using agentic AI without the product being labeled an “agent.”

IT and service management

An IT service agent can classify requests, search a knowledge base, collect diagnostic information, open or update tickets, and recommend remediation. Higher-risk actions, such as resetting privileged access or changing production systems, should normally require explicit approval.

Security operations

Security agents can enrich alerts, correlate events, query threat intelligence, summarize investigations, and prepare response actions. Some systems can isolate an endpoint or disable an account, but those capabilities require careful authorization, testing, and rollback procedures.

Organizations should document how agents participate in an incident response playbook, including escalation paths, approval requirements, evidence handling, and recovery steps. Endpoint protection tools such as Malwarebytes may support defensive operations, but they do not replace access controls, human oversight, or a tested response process.

Software development

Coding agents can inspect a repository, propose changes, run tests, fix errors, and create a pull request. The agent may be productive while still producing insecure code, changing unrelated files, or mishandling secrets. Branch protection, code review, secret scanning, and restricted credentials remain necessary.

Business workflow automation

Organizations use agents to process documents, route requests, reconcile information, draft communications, and update business applications. The agent’s access to customer, financial, health, or employee data makes data boundaries and auditability central design requirements.

Customer support

Support agents can retrieve account information, answer questions, classify cases, and initiate approved workflows. Businesses need controls against unauthorized disclosure, social engineering, and irreversible actions performed from an ambiguous request.

Personal and consumer applications

Consumer assistants may schedule tasks, search services, manage files, or interact with connected applications. The convenience comes with questions about consent, account delegation, data retention, and what happens when the agent misunderstands an instruction. Where an agent interacts with personal accounts, a password manager such as 1Password can help users manage unique credentials, but users should still review delegated access and connected applications.