Chapter 4 · What an agent actually is
The Thursday demonstration
Priya Nair built the thing everyone remembers in about four hours on a Thursday in the last week of February.
She was not trying to build a product. Dana had asked whether the model could hold Ostermill's tone policy at all, which is a fair question with a cheap answer, and Priya answered it the way an architect answers questions, by making the smallest thing that settles it. A prompt describing the tone. A copy of the aging report. Twelve accounts pasted in one at a time.
The letters came back better than the template Ostermill had been sending since 2011.
She showed six people on Friday morning. Marcus, the controller, read three of them and said they were better than what his team sends, which was true. Tom read one for an account he covers and said he would have been happy to receive it, which was also true and mattered more to him than it did to anyone else in the room. By eleven o'clock the conversation in that room had changed from whether this should exist to when they could have it, and nobody noticed the change happening.
Priya noticed. She had spent four hours on it and she knew exactly what she had not built.
What the Thursday demonstration proved is that a model can write a collections letter. That was never in doubt and it was never the question. The question is whether a system can decide which letter, to which account, on which day, and stop when it should not send one at all, and not one minute of those four hours went anywhere near that.
Dana noticed too, and she noticed for a reason that had nothing to do with Ostermill.
She had shipped one of these before. What she had learned from it is that the failure comes in two shapes, and only one of them looks like carelessness.
The first shape is the crude one, and it is at least honest. You are running at a date. Velocity is the number on the wall, general availability is the number in the board deck, and governance work moves neither. So you ship, and you move on, and there is no second phase because there was never going to be one. Nobody lied about it. Nobody planned it either.
The second shape is the one that catches good teams, and it caught hers.
You decide up front to crawl, then walk, then run. You write the roadmap out properly, because you are not naive about what you are shipping. You know exactly which parts are workarounds, since you wrote them: the snippet that reconciles two ID formats, the hard-coded list, the report somebody assembles by hand every Monday because the real pipeline is a fortnight out. All of it shipped to keep leadership and the sales team inside their quarter. All of it documented. All of it agreed by everyone in the room to be temporary, and everyone means it.
Then the quarter turns. A customer escalation eats three weeks. A migration nobody scheduled eats four. Two people leave. The walk phase moves once, reasonably, and then again, and after the third time it stops being a date and becomes a heading.
Eighteen months later that tool had four hundred users, two contractual commitments, and an audit trail somebody had built in a weekend. Crawl was the architecture. The roadmap still existed, still accurate, still describing a walk phase that had never once been staffed.
That is the part worth sitting with, because it inverts the obvious lesson. The roadmap is not the defense against this. The roadmap is what makes it comfortable. A team holding a written plan to fix the thing feels like a team that is fixing the thing, and the document keeps that feeling alive long after the work stopped being scheduled.
Nobody could say when it had become too late, because there was no moment when it did. There was only a floor nobody had built, and layers stacking on it.
Dana calls it the house of cards, and the thing she says about it is worth taking out of this chapter: minimum viable without minimum viable safety is just minimum.
That was a tool. It recommended, and a person acted. What Ostermill was now discussing would act on its own, and the same stack of deferrals under a thing that acts is a different kind of building.
The six parts, and the two Priya had
Priya's objection, when she finally made it the following week, was not that the demonstration was bad. It was that six things have to be true before the word agent applies, and she did not have most of them.
A model. The part everyone starts with, and the part you did not build and cannot inspect. It supplies language and reasoning. It supplies no knowledge of Ostermill whatsoever, and it will be replaced under you on a schedule somebody in another company controls. Priya had this. Everyone always has this; it arrives with a contract.
Context. Everything the system knows about this specific case at the moment it acts. Account history, payment behavior, the tone policy, whether a dispute exists, whether Tom's team has the account in play this quarter. The demonstration had one account pasted into a prompt by hand, chosen by Priya, from a report she had already looked at. The product needs retrieval that reaches four systems and one that does not exist, and Chapter 6 is about why this is the part every project underestimates.
Tools. The things it can do rather than say. Read the aging report. Query remittance advice. Write to a queue. Post a write-off under the small-balance floor. Every tool is a permission, and the list of tools is a more honest description of an agent than any paragraph about it. The demonstration had none. It could not do anything, which is why nobody had to think about what it should be allowed to do.
A loop. The part that makes it an agent rather than a function. It reads, decides whether it has enough, fetches more, reconsiders, and keeps going until it reaches something it will commit to. Priya's version ran once and stopped, because she typed the input herself and she already knew what mattered about it. A real one goes around as many times as the case requires, which is why the cost per case varies by a factor nobody predicts.
A boundary. What it may do alone, what needs a person, what it must never touch. The demonstration had no boundary because an artifact that cannot act does not need permission, and this is the part that makes demonstrations so misleading. They are safe in a way the product can never be, and the safety comes from impotence rather than from design.
A supervisor. Somebody whose job includes watching it, with a surface built for that job. Not somebody who would notice eventually. Somebody assigned, whose calendar reflects it.
Priya had two of the six. A model, and a gesture at context.
That gap is the entire distance between an impressive Thursday and a product, and it is why the Thursday is dangerous rather than useful. It moved the room's attention to the quality of the letter, which was never at risk, and away from the four missing parts, which are the whole build and which nobody had costed.
Dana's note in the file that week is short. We have proven the easy part and shown it to the people who approve the hard part.
Where the word stops applying
Two things get called agents that are not, and Ostermill had one of each already, which is more common than anyone expects.
The dunning module, standard accounting software that sends payment reminders on a fixed schedule, is the clearest case. The one Ostermill had licensed and never switched on is not an agent, and would not become one if somebody wired a model into it to improve the wording. If the sequence of steps is fixed and a model fills in language at step three, that is automation with a language feature. It is often exactly the right thing to build. It is cheaper, more predictable, easier to defend to a controller like Marcus who has to sign for the number, and calling it an agent buys you governance attention you will need somewhere else.
The reporting assistant in the finance team's spreadsheet is not one either, though it is the thing most people picture when they hear the word. A person asking questions and reading answers is a person using a tool. It proposes, they dispose, and every decision in the sequence belongs to a human who made it in that moment. The moment it starts acting on its own conclusions it becomes a different product with different obligations, and that transition usually happens without a meeting.
The test is not sophistication, and it is not how impressive the output is.
The full answer is the six parts above. The short one fits in a question you can ask out loud in a meeting. Does the thing choose what to do, case by case, rather than executing a rule somebody set? If it does, you are building an agent, and everything in this book applies to you. If it does not, you are building a tool, and most of it does not.
The reminder agent Ostermill eventually built passes. Every week it reads the accounts on the aging report and decides which of them get written to and which get handed back to Ruth with a reason attached, and nobody chooses account by account. A person still releases each letter, which is what keeps it low on the ladder rather than off it, but the choosing is the agent's.
The licensed dunning module fails. It chooses nothing. It sends on a rule somebody set once and has not looked at since, and a rule executing is not a decision being made.
The Thursday demonstration fails too, whatever the room believed at eleven o'clock on Friday. Priya picked the account, pasted it in and read what came back. Nothing changed in the world that she had not chosen herself, one account at a time, and a thing that decides nothing is not an agent no matter how good the letter is.
One more thing about the module, because that verdict invites a misreading.
Failing this test is not a safety rating. The module decides nothing, and it also asks nobody. It sends with no person in the path. The reminder agent decides a great deal, and a person releases every letter it writes.
Two different questions are being asked, and they come apart. Whether the thing chooses is what this chapter is about, and it decides whether the rest of this book applies to you. How much it may do before somebody looks is a separate question, it is the subject of Chapter 10, and it is the one that sets what a system costs and what it can break.
They are not the same axis and they do not move together. A system with no judgment and no supervision does more damage in a week than a system with judgment and a person reading its output. Ruth's week is the proof. The module sends to all forty-one of the accounts she held back. The agent may draft for a handful of them, and a person reads every draft before it goes.