Photo: Compagnons / Unsplash
Imagine planning a trip from Ottawa to Montréal.
An AI chatbot can suggest train times, compare travel options and help you put together an itinerary. You still have to make the booking.
Now imagine giving an AI system access to your calendar and a travel-booking service. It could check your availability, look up fares and prepare a booking. With additional permission, it might purchase the ticket.
The change is straightforward: software moves from offering advice to taking action on your behalf. That's the idea behind AI agents.
So what is an AI agent, actually?
An AI agent is a system that can work toward a goal by gathering information, choosing steps and using available tools to complete a task.
Rather than needing instructions for every step, it can respond to what it finds. If an agent is arranging a meeting and discovers someone is unavailable, for example, it might look for another time instead of asking you to start over.
Agentic AI is the broader approach of using one or more agents to carry out tasks with some degree of independence.
That does not mean an agent thinks or exercises judgment like a person. Its choices depend on the model, tools, information and instructions people have provided.
The terminology isn't always consistent. Some products marketed as agents follow limited workflows; others coordinate several tools. And today's AI assistants can already search websites, work with documents or operate connected applications, making the line between a chatbot and an agent less clear-cut.
The useful question isn't what a product calls itself. It's what the system can do without your intervention.
The difference to remember: answering versus acting
Consider a spreadsheet.
A chatbot can suggest formulas or explain which figures to check. An agent with access to the spreadsheet could make those changes itself.
That difference depends as much on the system's permissions as on its capabilities. One agent might prepare changes for your approval; another might be allowed to update records automatically within rules you've set. Both can still be supervised.
Agentic AI also differs from ordinary automation. Traditional automation typically follows predefined instructions: when a form arrives, save it to a folder; when a payment is received, send a receipt.
An AI agent can use a model to choose among possible steps, respond when circumstances change and select which available tool to use next. The two approaches can work together, and for simple, predictable tasks, ordinary automation may be enough.
How does an AI agent know what to do?
An agent generally needs three things: a goal, instructions and access to tools.
The goal defines the task. The instructions set boundaries, including when approval is required. The tools let the agent interact with systems such as a browser, calendar, document library or business application.
It can then choose an action, use a tool, examine the result and decide what comes next. That cycle may repeat until the task is done or a person needs to step in.
For a monthly report, an agent might open an approved data source, notice a missing figure, check another permitted source and put the results into a draft for review.
But agents can misunderstand instructions, use inaccurate information or choose an unhelpful next step. The ability to act without constant prompting is useful only when those limitations are taken seriously.
What could this look like in Canada?
A small business might use an agent to organize appointment requests and prepare customer confirmations. An employee could use one to gather information from approved systems and draft a monthly report. A customer-service team might use one to find relevant records and prepare responses for staff review.
These are possible uses, not promises about what every available product can deliver reliably.
The Government of Canada's Guide on the Use of Agentic Artificial Intelligence describes potential public-service applications, including gathering policy information, preparing analysis and checking whether applications contain required information.
An agent could help identify missing documents without being authorized to decide whether someone qualifies for a public benefit. The guidance emphasizes human accountability for consequential decisions and actions.
These examples describe possible ways to support public servants, not evidence that federal departments have deployed agents to perform each of those tasks.
What changes when an agent gets something wrong?
An incorrect chatbot answer might mislead you. An incorrect agent action could change a record or send a message before anyone notices.
Suppose an agent misreads a customer file, updates the wrong details and sends a confirmation based on that mistake. One error has now affected several steps. An incorrect entry could then be copied into a report or passed to another system, extending the consequences of the original mistake.
An agent reading websites or emails may also encounter malicious instructions hidden in material it is meant to process. This is known as prompt injection: content the agent should treat as information attempts to tell it what to do. Broad permissions could make the consequences worse.
Canada's federal financial-sector regulator, the Office of the Superintendent of Financial Institutions (OSFI), has highlighted risks involving access, oversight and security in agentic systems. Its guidance points to practical controls, including activity records and approval checkpoints for consequential actions.
Agents aren't inherently unsafe. But their safeguards must reflect what they are allowed to change.
The two safeguards worth understanding
Canada's federal guidance identifies two useful principles: bounded autonomy and recoverability.
Bounded autonomy means an agent operates within clear limits. If it needs to read your calendar, it doesn't automatically need permission to change appointments. If it drafts an email, sending it can remain a separate approval step.
Recoverability means people can inspect what the agent has done, interrupt it and correct mistakes where possible. That calls for understandable activity records and practical ways to pause or stop the system.
Not every action can be reversed. An email might already be sent, a purchase might incur fees, or a sensitive document might already have been shared. Some steps need approval before they happen.
Giving an AI agent a task is one thing. Giving it the authority to act is another.
Canada's guidance sets out these principles for federal government use, but the questions apply just as well to personal and workplace tools.
What should you check before using one?
You don't need to understand an agent's technical architecture to ask four useful questions:
What can it access? Files, messages, calendars or connected services?
What can it change? Can it only prepare information, or can it send, edit, delete or spend?
When does it need approval? Are consequential actions reviewed before they happen?
Can you see and stop what it's doing? Is there a record of its actions and a way to intervene?
Start with a limited task, check the results and expand permissions only when there's a clear reason. A system that organizes information isn't automatically ready to handle confidential material or financial transactions.
Our read
AI agents could change how we use software, moving beyond generating information to carrying out connected tasks. That could make routine administrative work easier, from collecting documents to preparing reports.
But greater autonomy isn't automatically better. An agent that reliably completes three useful steps with human oversight may offer more value than one that attempts twenty and leaves you wondering what happened.
The opportunity is to delegate suitable work without giving up judgment or accountability.
For readers, the next step is not to adopt an agent for everything. It is to recognize which tasks have real-world consequences and decide how much independence, if any, makes sense.
When a product promises agentic AI, look beyond how independent it sounds. Ask what it can do reliably, what authority it needs and whether you remain in control.
The Weekly Brief — Issue 06
How Quebec is preparing for potential uses of AI agents in government.
The Weekly Brief — Issue 14
Why AI agents are changing the cybersecurity questions facing federal systems.
AI at work: what to learn first
The practical habits that help people use AI tools effectively, check their work and protect sensitive information.
