What is the role of an agent?

Everyone's Deploying Agents, But Few Can Define Them

Ask five vendors what an "AI agent" is and you'll get five different answers. Yet the adoption numbers are unambiguous: 79% of executives say agents are already being adopted in their companies, and 96% of IT leaders plan to expand agent use within the next 12 months. Everyone is deploying them. Almost no one agrees on what "them" means.

The Frontier Model Forum, an industry body focused on frontier AI safety, has explicitly noted that no settled, standardized definition of "AI agent" exists. That matters more than it sounds. If you can't define what an agent is, you can't reason clearly about what it's allowed to do.

The clearest working framing comes from Anthropic's engineering team, which distinguishes between two patterns that often get lumped together:

• Workflows — systems where LLMs are orchestrated through predefined code paths. The automation is fixed; the model fills in the steps.
• Agents — systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how a task gets completed.

That distinction is the difference between software that follows your instructions and software that decides its own path. An agent plans, invokes tools, queries external services, and adapts to environmental feedback in a loop — gathering "ground truth" at each step until it hits a stopping condition or a checkpoint where a human takes over.

This is why definitions matter practically, not just academically. Before you hand an agent tools and permissions, you need to understand what it will actually be responsible for: decision-making, task planning, memory across sessions, and escalation to humans when it reaches the edge of its competence. The Frontier Model Forum puts it bluntly: "every tool an agent can access expands both its capability and its exposure," and the potential damage from an agent failure scales directly with the trust and permissions you've granted it.

So the real question isn't whether to adopt agents — the market has answered that. It's what responsibilities you're delegating, and how much autonomy each responsibility deserves. Getting that mapping right is the foundation for everything that follows. And when you do start equipping agents with skills and tools, vetting what you attach matters: research has found that roughly 26% of published agent skills carry at least one vulnerability, which is why SkillzBench is building a free directory that security-scans, version-pins, and benchmarks every skill before you connect it through its free MCP tool.

The Five Core Responsibilities of an AI Agent

Strip away the hype, and an AI agent is doing five things over and over: planning, calling tools, remembering, deciding, and knowing when to hand work back to a human. Anthropic's engineering team offers the most grounded description in the industry: agents are "just LLMs using tools based on environmental feedback in a loop" — and that loop is where all the value lives.

1. Planning and executing multi-step tasks. Unlike a scripted workflow, an agent directs its own process. Give it a goal, and it breaks the work into steps and completes them autonomously — the defining trait Blue Prism calls "autonomy, decision making and task planning." Anthropic recommends reserving agents for open-ended problems where the steps genuinely can't be predicted in advance.

2. Invoking tools and querying external services. The Frontier Model Forum defines an agent as a system that uses external tools to perform goal-directed tasks on behalf of a user — searching databases, calling APIs, interacting with other agents. This is also the main risk surface: every tool an agent can access expands both its capability and its exposure.

3. Maintaining memory. Agents carry context across steps and sessions, letting them handle both structured and unstructured data — invoices, tickets, documents, conversations — without starting from scratch each time.

4. Making decisions and adapting to feedback. Anthropic emphasizes that agents gather "ground truth" from the environment at each step, adjusting course based on what they find. PwC's survey of 308 executives found agents running in the background to streamline tasks or responding actively to gather insights, solve problems and get work done — with 66% of adopters reporting measurable productivity gains.

5. Escalating to humans at checkpoints. Responsible agents pause for human feedback at defined checkpoints, with stopping conditions like maximum iterations. Trust is earned, not assumed: executives report high trust for data analysis (38%) but far lower for financial transactions (20%).

Where do agents fit relative to RPA? Not in opposition — in tandem. The hybrid pattern works like this:

• RPA extracts — deterministic, rules-based work like pulling invoice data from a system.
• Agents evaluate — reasoning over context to decide what the data means and what should happen next.
• Humans resolve — anything ambiguous, high-stakes, or outside policy gets routed to a person.

Agents suit non-deterministic processes that require goal setting, reasoning, or context awareness; RPA handles the predictable middle. If you're extending agents with skills and tools, SkillzBench is building a free directory and MCP connector to discover, verify, and benchmark skills before you equip an agent — because a tool-using system is only as trustworthy as the tools it can see.

Where Agents Deliver Value — and Where They Don't

Here's the gap between the hype and the ledger: while 79% of executives say agents are already being adopted, dedicated agent platforms captured just $750M — 10% of horizontal AI spend — compared to copilots at 86%, according to Menlo Ventures' enterprise AI analysis. Agents are emerging, not yet dominant, and the value they deliver is concentrated in specific, measurable areas.

The productivity story is real, if more modest than headlines suggest. In a PwC survey of 308 US executives, 66% of agent adopters reported measurable value through increased productivity, with 57% citing cost savings and 55% pointing to faster decision-making. That is genuine return — but it also means a third of adopters have nothing measurable to show yet.

Where are agents actually working? The PwC data shows planned or active use concentrated in three functions: customer service (57%), sales and marketing (54%), and IT and cybersecurity (53%). The Cloudera survey of roughly 1,500 IT leaders adds a technical layer, with the top applications being performance optimization bots (66%), security monitoring agents (63%), and development assistants (62%).

• Customer service and sales — ticket routing, sentiment analysis, and proactive outreach, often embedded in departmental tools rather than standalone agent platforms.
• IT operations and security — incident response automation and continuous security monitoring, where agents watch for anomalies humans would miss.
• Software development — coding assistants that have made coding AI's first "killer use case" at $4B in enterprise spend.

There's also a clear "where not to use them." Anthropic's engineering guidance is blunt: reserve agents for open-ended problems where the steps can't be hardcoded. If you can predict the sequence of actions, a workflow with predefined code paths is cheaper, faster, and more reliable. Agents trade latency and cost for task performance — a trade only worth making when the path genuinely can't be scripted in advance.

Trust data reinforces this selectivity. Executives report high trust in agents for data analysis (38%) but low trust for financial transactions (20%), per PwC — stakes matter, and autonomy should scale with tolerance for error.

The practical takeaway: match the tool to the problem's structure. Deterministic tasks belong in workflows or RPA; open-ended, multi-step judgment calls belong to agents. And when you do equip agents with tools and skills, vet them carefully — published research has found roughly 26% of agent skills carry at least one vulnerability, which is why SkillzBench is building security scanning, sandbox benchmarking, and per-agent skill loadouts so you only connect what's been verified.

Autonomy Is a Two-Edged Sword: The Responsibility of Oversight

The same autonomy that makes an agent valuable makes it dangerous. The Frontier Model Forum puts it plainly: "every tool an agent can access expands both its capability and its exposure." An agent that can read files, call APIs, and act on your behalf can also be redirected, misled, or abused — and the damage scales directly with the permissions you granted it.

Security bodies are sounding the alarm. NIST is soliciting public input on securing AI agent systems, warning that companies have adopted agents without plans to mitigate flaws and that poorly secured agents could be especially dangerous in critical infrastructure. The Frontier Model Forum's issue brief identifies the leading attack vectors as prompt injection, memory poisoning, and tool supply-chain compromise — attacks that exploit the agent's own reasoning and tooling rather than breaking traditional defenses.

The tool supply chain is where many adopters are most exposed. Published research found that roughly 26% of published agent skills carry at least one vulnerability — meaning the instruction packages and connectors teams pull in to extend their agents are themselves a risk surface. An agent is only as safe as the least trustworthy tool it can touch.

That's why governance isn't optional. Blue Prism notes that agents carry a high governance burden, requiring explainability, audit trails, risk management, and human oversight. In practice, that means building oversight into the design rather than bolting it on:

• Apply least-privilege access and per-task tool permissions, so an agent only reaches what its current job requires.
• Sandbox agent execution and maintain audit logs of every tool invocation.
• Pause for human feedback at checkpoints, and set explicit stopping conditions such as maximum iterations.
• Vet every skill and tool before an agent sees it — scan for vulnerabilities, pin versions, and track upstream changes.

That last point is the primary control. Because tool access is the main lever over both capability and exposure, deciding what an agent can see is the single most effective security decision you make. This is the problem SkillzBench is building for: a free directory of agent skills where every version is pinned to a commit SHA, security-scanned and benchmarked, plus a free MCP connector with per-agent loadouts — you toggle exactly which skills and tools each agent gets, and the agent only sees what you chose.

Trust scales with stakes, too. A PwC survey found executives trust agents far more for data analysis (38%) than for financial transactions (20%) — a useful instinct. Match the agent's permissions to the blast radius of its mistakes, and keep a human in the loop wherever that radius is large.

Putting an Agent to Work: A Practical Playbook

Knowing what an agent is only gets you halfway. The real question is how to put one to work without burning budget on a project that never leaves the demo stage — and the research points to a surprisingly disciplined playbook.

Start small and contained. Cloudera's survey of roughly 1,500 IT leaders recommends beginning with "fast-to-value" projects like an internal IT support agent to prove ROI before scaling — a sensible bet given that 96% of enterprises plan to expand agent use within a year. The pattern works because stakes are low, feedback is fast, and success is measurable in tickets resolved rather than vague productivity claims.

Keep it simple and composable. Anthropic's engineering team found the most successful implementations rely on simple, composable patterns — prompt chaining, routing, parallelization — with complexity added only when it demonstrably improves outcomes. As they put it in their building guide, success "isn't about building the most sophisticated system," and most agents are just LLMs using tools in a loop. Their practical checklist:

• Sandbox the agent and apply guardrails before granting real permissions
• Set explicit stopping conditions, such as maximum iterations
• Pause for human feedback at checkpoints rather than after failures
• Design the toolset deliberately — every tool shapes behavior

Treat tool access as your primary risk control. The Frontier Model Forum warns that every tool an agent can access expands both its capability and its exposure, which makes least-privilege access and audit logs non-negotiable. NIST has gone further, soliciting public input on securing agent systems after observing that companies adopt agents without plans to mitigate flaws.

Plan for orchestration, not isolation. PwC's survey of 308 executives is blunt: "Using a few AI agents in isolation won't move the needle." Only 42% of companies are redesigning processes around agents, which leaves a genuine first-mover gap for teams that connect agents across workflows instead of deploying scattered point solutions.

Once your agent handles a core workflow, the natural next step is extending it with skills — the instruction packages that teach agents to browse, code, or analyze. SkillzBench is building a free directory where every skill is security-scanned, version-pinned, and benchmarked for measurable Lift, plus a free MCP tool to connect chosen skills to any agent. You can browse, verify, and test skills there as the platform launches — because an agent is only as trustworthy as the tools you hand it.