AI agents: five questions that separate delegated work from a long answer

On July 17, 2025, OpenAI introduced ChatGPT agent as a system able to operate a virtual computer. Earlier that year, Anthropic had launched Claude Code in preview on February 24, and GitHub had introduced its coding agent on May 19. The three products turned a technical distinction into an everyday experience: the user no longer asks only for an answer, but for an outcome that requires opening resources, choosing steps, acting and checking.

“Agent,” however, does not mean total autonomy or guarantee successful completion. It describes an allocation of control. The durable skill is auditing that allocation through five questions: what goal does the system receive, which tools may it use, which signals let it verify progress, which actions require approval, and what evidence does it return? If a demonstration omits one, we still do not know how much work was delegated or how much risk was created.

The difference is who chooses the path

Anthropic’s engineering guide, published in December 2024, offers a useful distinction. In a workflow, models and tools follow predefined code paths. In an agent, the model dynamically directs its process and chooses how to use tools. Both can call a language model and perform multiple steps. What changes is where the decision about the next step resides.

An automation that takes an invoice, extracts three fields and sends them through a fixed route can be valuable without being an agent. A system given “reconcile these invoices” that inspects documents, chooses sources, runs checks, detects a discrepancy and decides whether it needs more information has more agency. This is not a metaphysical boundary; it is a continuum of discretion, access and duration.

A conventional chatbot usually operates for one turn: text in and text out. A copilot proposes actions inside a tool while the human maintains a short acceptance loop. An agent can chain observation, reasoning, action and a new observation without asking permission for every microdecision. A product may combine all three modes. Its commercial name is not a substitute for a capability map.

The first question, then, is which part of the path was not written in advance. If the system only fills a template, it is automation. If it chooses among search, code execution, browsing and clarification according to what it discovers, it has an agentic decision policy. The more open that policy becomes, the more important constraints and verification become.

Three launches with different boundaries

ChatGPT agent was introduced on July 17, 2025 as a combination of visual browsing, research and a terminal. The announcement showed tasks such as reviewing a calendar and news, planning a purchase or creating a presentation. The system could move among a browser, code and connected sources. OpenAI said it would ask permission before consequential actions and that the user could interrupt, take over the browser or stop the task.

This product extends the boundary to the open web and connected personal data. Its risk surface includes malicious instructions embedded in pages, information leakage, mistaken purchases and incorrect messages. The ChatGPT agent system card describes a remote browser, terminal with limited network access and connectors, and treats prompt injection as a tool-use risk. An agent can do more than answer incorrectly: it can obey external content that competes with the user’s instruction.

Claude Code began on February 24, 2025 as a research preview in the terminal. Anthropic said it could search and read code, edit files, write and run tests, commit and push changes, and use command-line tools. Its boundary was a repository and the available terminal tools. “Keeping you in the loop at every step” was part of the description, signaling a product that combined model initiative with oversight.

GitHub Copilot’s coding agent, introduced on May 19, 2025, used another architecture. It takes an issue, creates a GitHub Actions-powered environment, works in the background and returns commits in a draft pull request. GitHub limited pushes to agent-created branches, retained repository protections, restricted internet destinations and required approval before certain workflows ran. The person commissioning the work also cannot approve it where review rules apply.

All three are agents, but they are not interchangeable. One navigates and acts across services, another collaborates from a terminal, and the third delivers through a repository’s review unit. Comparing them on “autonomy” without describing tools, environment and approval boundary is like comparing vehicles only by maximum speed.

The loop that turns text into action

Every practical agent needs four components. The first is state: what it knows about the goal, completed steps and results. The second is a set of tools with clear contracts: search returns documents, a terminal returns output and status, and an API confirms or rejects an operation. The third is a policy that selects the next action. The fourth is a completion condition that prevents “looks finished” from being confused with “meets the assignment.”

Verification must rest on the world, not on the model’s fluency. A coding agent can run tests, but it should also check that those tests cover the change and that unrelated files were not modified. A research agent should open sources and map claims to documents. A calendar agent should reread date, time zone and attendees before proposing a send. A tool produces an observation; the agent needs criteria for deciding whether that observation is sufficient.

Errors compound because each step changes the context for the next. A poor search feeds an incorrect comparison, which produces a bad recommendation, which a permissioned tool can implement. Anthropic warns that agents trade latency and cost for performance, while autonomy can increase both and allow compounding errors. The answer is not to eliminate every loop, but to constrain its length, budget and authority according to possible harm.

Autonomy is not authority

A system can choose many steps while still lacking permission to send, buy, deploy or delete. This separation is crucial. Autonomy describes who chooses the procedure; authority describes which changes may be confirmed. A sound design gives latitude over reversible, read-only actions and places informed approval before external or difficult-to-reverse effects.

Approval is ineffective when it arrives as a blind button. It should show what will happen, to which account or resource, for what amount or recipient, and from which evidence. It should not produce fatigue either. Confirmation on every trivial click teaches people to accept without reading. Control points belong at risk boundaries, not arbitrary intervals.

Access should follow the same principle. A supplier-comparison task may need browsing and one folder, not an entire mailbox or purchasing credentials. GitHub’s isolated agent environment and agent-created branches illustrate how to reduce blast radius. OpenAI’s ability to stop and take over adds recovery, but recovery does not replace least privilege.

How to evaluate an agent with real work

Begin by writing the outcome and prohibitions: “Prepare a comparison using three primary sources; do not send messages or buy anything; mark missing data.” Then define a human reference and a case set that includes incomplete situations and hostile content. Measure final success, critical-step accuracy, cost, time, interventions, recovery and unauthorized action. A completion rate that ignores harm and review is inadequate.

The output evidence should be inspectable: links and claim mapping for research; a diff, tests and logs for code; an exact preview for a form or calendar. An agent that returns a slightly smaller but traceable result is preferable to one that supplies a polished conclusion with no verification path. Human review can then focus on decisions and exceptions rather than repeating the entire task.

Finally, choose the simplest level that clears the threshold. If a fixed route works, a workflow is cheaper and more predictable. If the job requires adapting steps to discovered information, an agent may add value. If impact is high and verification weak, it should not receive authority even if the model appears capable. Maturity is measured not by how many clicks it performs alone, but by how much verifiable work it completes inside explicit boundaries.

This method applies to every new announcement. Asking about goal, tools, verification loop, approval and evidence reveals more than the label. The 2025 agents made the transition from dialogue to action tangible; the durable competence for 2026 and beyond is designing delegation in which capability, permissions and accountability are never confused.