An agentic system plans and acts, and that changes the cost of being wrong
The line that matters is not how capable the model is. It is whether the system can act without a human in the loop. Once it can, permissions, verification and the option to stop become part of the design rather than afterthoughts.
What makes a system agentic?
It selects its own next step and executes it. A model that answers produces text for a human to review; a model with tools produces effects in other systems. The freedom to decide what to do next is what makes an agent useful, and also what makes a wrong decision expensive, because nothing between the decision and the effect is checking it.
From answering to acting
The shift is not a change of model quality. It is a change in what the output is attached to.
An answering system produces a claim. An acting system produces a claim, chooses a tool, supplies arguments, observes a result, and repeats. ReAct is the clearest published statement of that pattern: reasoning traces interleaved with task-specific actions, so a model can plan, handle exceptions, and query an external source to gather information it lacks.
That is why knowledge failures behave differently here. In one response a bad fact affects a sentence; in a loop it becomes an input to the next decision, and the system has no reason to revisit it.
Permissions and blast radius
A wrong answer is cheap because a person reviews it before anything happens. A wrong action is not, because by the time it is reviewed the effect exists.
The useful way to reason about this is blast radius: the set of things that can change if the agent is wrong.
- What may it read? The scope of knowledge an agent can consult sets the ceiling on how wrong it can be.
- What may it write? Reads are recoverable; writes are not. The distance between "the agent can see this" and "the agent can change this" is the most valuable boundary to draw explicitly.
- What may it call? Tools extend an agent beyond its own boundary — into mail, calendars, payments, infrastructure. Each adds a surface through which a wrong decision becomes an executed one.
The instinct is to grant enough permission to succeed; the safer default is the narrowest permission that completes the task, with escalation as an explicit step. Enterprise knowledge work faces the same governance problem at organisational scale.
Verification and the abstain option
An agent needs a way to check itself, and a way to stop. Both are design decisions.
Verification means the agent's claim about the world is checkable against something it can retrieve — what it used, whether that was current, and whether it was permitted. An agent that cannot show its basis is not verifiable, whatever its accuracy. This is the grounding discipline that makes an action auditable after the fact.
Abstention is the harder half. An agent that must complete a task will complete it, substituting a plausible guess for a missing fact and then acting on the guess. Abstaining has to be available, permitted, and cheaper than guessing: the agent can stop and ask, the interface lets it decline, and evaluation does not punish stopping. Where memory is what the agent draws on, the same discipline applies to what was written down — see memory for assistants and agents.
Compounding failures, and what is established
Knowledge failures compound because each step consumes the previous step's output. A retrieval miss in step one becomes a wrong argument in step two and an executed tool call in step three. No step is designed to notice, because each looks locally reasonable.
Protocols address the mechanics of reaching things. MCP standardises how an application exposes tools, resources and prompts to a model, so an agent needs no bespoke integration per tool. A2A covers the case where the thing being reached is another agent, defining how independent agents describe themselves and delegate work. The agents page covers that surface in more detail. Both reduce integration cost; neither reduces judgement risk, and both enlarge the blast radius by making more surfaces reachable.
Be plain about which claims rest on published work. The reason-and-act loop, its reduction of hallucination and error propagation through querying an external source, and its advantage over chain-of-thought alone on question answering and decision-making benchmarks are documented in the ReAct paper below. The protocol layer is real and adopted, but much said around it — that agents are production-ready, that multi-agent architectures outperform single agents — is vendor framing.
FAQ
No. The distinction is whether the system plans and acts, or only answers. A system that produces text for a human to review has no blast radius; one that selects its own next step and calls tools does.
Because an answer is reviewed before it has consequences and an action already has them. A wrong answer costs a correction; a wrong action costs a record change, a sent message, or a downstream decision other systems have already consumed.
No. Abstaining is a designed behaviour, not a failure. If the knowledge needed is missing, stale, or outside the agent's permission, stopping and asking is cheaper. An agent that cannot abstain substitutes a plausible guess, and then acts on it.
Protocols such as A2A and MCP standardise how agents and tools are reached, which makes integration easier and the blast radius larger: an agent that can delegate has more surfaces through which a wrong decision can be executed. A protocol governs reach, not judgement.
Sources
- Yao et al., ReAct: Synergizing Reasoning and Acting in Language Models — arxiv.org/abs/2210.03629. Reasoning traces interleaved with task-specific actions; querying an external source reduces hallucination and error propagation relative to chain-of-thought alone.
- Agent2Agent (A2A) Protocol — a2a-protocol.org. A protocol for how independent agents describe themselves and delegate tasks to one another.