Technical Guide
What Is an AI Agent? Definition, Types, and Governance Requirements
An AI agent is a system that combines a large language model with a planning or reasoning loop and the ability to invoke external tools, APIs, or other agents to complete multi-step tasks with limited human intervention. This distinguishes agents from single-turn chatbots or static LLM applications. Because agents can take actions rather than only generate text, they require governance controls, including agent identity, scoped permissions, and audit logging, that are proportional to their level of autonomy.
Agent Autonomy and Governance at a Glance
Before the full definition, here is a summary of how agents are structured and what governing them typically requires.
Definition
LLM plus planning loop plus tool-calling capability.
Autonomy spectrum
Human-in-the-loop, human-on-the-loop, fully autonomous.
Architecture types
Single-agent, multi-agent, orchestrated.
Core governance needs
Identity, permissions, auditability, oversight.
Defining an AI Agent
An AI agent is a system that combines a large language model with a planning or reasoning loop and the ability to invoke external tools, APIs, or other agents to complete multi-step tasks with limited human intervention. The planning loop is the defining feature: an agent does not simply respond to a single prompt, it evaluates intermediate results and decides what to do next, chaining actions together until a task is complete or it determines further human input is required.
Why Agents Differ From Chatbots and LLM Applications
A conventional chatbot or LLM application generates text in response to a prompt and stops. Even when such a system is connected to a plugin or a single API call, it is typically executing one discrete action per user turn, with a human deciding what happens next. An agent, by contrast, can independently sequence multiple tool calls, interpret their outputs, and adjust its plan without a human specifying each intermediate step. This shift from generating text to taking action is what introduces new operational and security considerations that do not apply to purely conversational systems.
Common Agent Architectures and Risk Considerations
Agent architectures generally fall into a few recognizable patterns. A single-agent system uses one model with a defined tool set to complete a task end to end. A multi-agent system distributes work across several specialized agents that communicate to accomplish a shared goal. An orchestrated system uses a coordinating layer to route tasks to the appropriate agent or tool. Each pattern carries different risk characteristics: single-agent systems concentrate risk in one set of permissions, while multi-agent and orchestrated systems distribute risk across more components and more points of communication.
Multi-Agent Systems Introduce Additional Trust Boundaries
When multiple agents communicate to complete a task, each inter-agent exchange represents a trust boundary that did not exist in a single-agent design. An output produced by one agent may be treated as a trusted instruction by another, which means that a compromised or manipulated agent can potentially influence the behavior of others in the system. Governance for multi-agent deployments therefore needs to account not only for what each agent can do, but for what each agent is willing to accept from another agent as valid input.
Protocols Like MCP Change the Security Conversation
The Model Context Protocol (MCP) and similar standards define how agents connect to external tools and data sources in a consistent way. Standardization makes integration easier, but it does not make a deployment secure by default. MCP's 2025 revisions added OAuth-based authorization for remote servers, yet the security of any given deployment still depends on whether that authorization is correctly implemented and whether permissions granted through it are scoped to what the agent actually needs.
Frequently Asked Questions
Is an AI agent the same as a chatbot with plugins?
Not exactly. A chatbot with plugins may call a tool in response to a prompt, but an agent maintains a planning loop that can chain multiple tool calls, evaluate intermediate results, and decide on next steps without a human specifying each one. The planning loop, not the presence of any single tool call, defines an agent.
Do all AI agents require the same governance controls?
No. Governance should be proportional to autonomy and risk. A supervised agent requiring approval for each action needs different controls than a fully autonomous agent executing guardrailed actions independently, per NIST AI RMF guidance on scaling oversight to system risk.
Does using MCP make an agent deployment secure by default?
No. MCP standardizes how agents connect to tools and data sources, and its 2025 revisions added OAuth-based authorization for remote servers. Security still depends on whether that authorization is correctly implemented and whether permissions are scoped appropriately.
What is "excessive agency" in agent governance?
Excessive agency, as defined by OWASP, occurs when an LLM-based system is granted more functionality, permissions, or autonomy than its intended operation requires. Mitigating it means limiting an agent's tool access and independent action to what is operationally necessary.
Baseline Governance Requirements Before Production Access
Regardless of architecture, the following controls establish a minimum standard for operating agents safely in production.
- Assign each agent a unique, auditable identity rather than shared or embedded service credentials
- Scope permissions per tool or action at a granular level, independent of the underlying model configuration
- Maintain logs of tool invocations, inputs, outputs, and inter-agent communications for audit and incident investigation
- Match human oversight mechanisms, such as pre-action approval or monitored override, to the agent's actual autonomy level
- Verify that protocol-level authorization, such as OAuth flows for MCP servers, is implemented rather than assumed
- Define escalation and kill-switch mechanisms that allow operators to interrupt or disable agent actions in production
Bring Runtime Governance to Your AI Agents
Trussed AI provides runtime governance and security for enterprise AI agents, including agent identity, least-privilege permissioning, tool approval workflows, and audit logging aligned to how your agents actually operate in production.
Request a Demo