Agentic AI
AI that plans a sequence, calls tools, observes the result and keeps going until the task is done — an action loop, not a chat bubble.
Agentic AI can plan a sequence, call tools, observe the result and continue until a task is complete. The difference from a chatbot is the action loop and the audit trail.
Agentic AI can plan a sequence, call tools, observe the result and continue until a task is complete. The difference from a chatbot is the action loop and the audit trail.
All glossary terms
The short version
- Agentic AI is a capability class: a system that plans a sequence of steps, takes actions through tools, observes the results and continues until a goal is met or a limit is hit.
- The action loop is the definition. A model that only produces text is not agentic, however good the text is, and a workflow with one language-model step is automation, not agency.
- Autonomy is a dial, not a badge. The useful settings run from suggest, through draft, to act with approval, to act within a bounded budget.
- The risk surface is the tools, not the prose. Every agent is exactly as dangerous as the credentials it can reach and exactly as trustworthy as the trace it leaves.
- For Indian teams, agency over money, consent and regulated advice needs a human gate and a record. DPDP makes the record a legal artefact, not a nice-to-have.
- Evaluate the trajectory, not the final message. A run that reached the right answer through a wrong path will fail differently next week.
Agentic AI, defined by the loop
Agentic AI describes systems that pursue a goal over multiple steps rather than answering a single prompt. The distinguishing feature is a loop: the system forms a plan, takes an action through a tool, observes what happened, revises the plan, and repeats. A language model supplies judgement inside that loop, but the loop itself, with its state, its tools and its stopping conditions, is what makes the behaviour agentic.
This definition is narrower than the way the phrase is used in vendor decks, where any product with a chat box and a database lookup is called agentic. It is also broader than the way some engineers use it, reserving the term for fully autonomous systems that need no supervision. Neither usage is useful for a team trying to decide what to build. The operational question is simpler: can the system take an action whose result it must then react to? If yes, it is agentic and it needs the controls that follow.
What agentic AI is not: it is not a model family, it is not retrieval, and it is not a synonym for an Agent OS. Retrieval improves what the model knows at answer time. Agentic behaviour changes what the system does after the answer. The OS is where that behaviour is operated. A single sentence can hold all three: the OS runs an agentic agent that uses retrieval to decide its next action.
What happens inside one iteration
An iteration has four parts. The planner turns the goal and the current state into the next step. The router picks a model and a tool for that step. The executor calls the tool with typed arguments and captures the result. The critic compares the result against the goal and decides whether to continue, change approach or stop. In a mature system the critic is partly deterministic: a schema check, a threshold, a rule that says a payment above a limit cannot proceed.
The quality of the loop depends more on the state than on the model. If the agent does not know what it has already tried, it will try it again. If the tool result is truncated to a success flag, the critic has nothing to reason about. If the plan is regenerated from scratch every turn, the agent drifts. Persistent state, full tool results and a stable goal representation are what make a loop converge instead of oscillate.
Iteration limits are not a detail. Every loop needs a maximum step count, a maximum spend, a wall-clock deadline and a defined escalation when any of them is reached. Without those, a confused agent is an unbounded process, and an unbounded process attached to a paid API is an invoice.
Agentic AI is not automation, retrieval or an Agent OS
Automation follows a path a human specified in advance. Agentic AI chooses the path at runtime. That distinction sounds academic until something goes wrong: an automated invoice reminder that misfires can be traced to a rule, while an agentic one that decides to escalate a customer to collections has made a judgement that needs a record. Automation is predictable and brittle; agency is adaptive and needs oversight. Most real systems should be a workflow with a few agentic steps inside it, not an agent that reinvents the workflow every morning.
Retrieval-augmented generation is a technique for supplying context, and it is not agentic on its own. A RAG chatbot that retrieves three passages and answers is a single-turn system. The moment it decides to search twice, open a ticket and then reply, it has crossed into agency. That crossing is where retrieval quality stops being the main risk and tool permissions become the main risk.
An Agent OS, finally, is the runtime: the services for state, tools, policy, memory and trace. Agentic AI is the behaviour those services support. An AI SDR is a job built from that behaviour. Three layers, three different questions in a procurement review: what can it do, where does it run, and who does it replace or assist.
The autonomy ladder and how to choose a rung
Autonomy is easier to reason about as five rungs. At the first, the system suggests and a human does everything. At the second, it drafts and a human edits before sending. At the third, it acts but waits for approval on each consequential step. At the fourth, it acts within a bounded budget and a defined scope, escalating exceptions. At the fifth, it acts unsupervised across its whole scope, which is appropriate for very few customer-facing jobs and almost never at the start.
The mistake is treating the top rung as the goal. The right rung is the lowest one that produces the value you want. If a human approves every draft in eight seconds, the labour saving is real even at rung two, and the risk is negligible. Moving to rung four requires evidence: a run of clean traces, a measured error rate, a rollback path and someone accountable for the exceptions.
Rungs should be assigned per action, not per agent. The same collections agent might act unsupervised when sending a payment link, act with approval when offering a settlement, and never act at all when writing off a balance. Drawing those lines is a business decision, and it should be written down before the agent is built, because retrofitting a gate into a live flow is much harder than designing one in.
Tools are the risk surface
An agent with a read-only calendar tool is a scheduling assistant. The same agent with a tool that can issue refunds is a financial control. The difference is not the model, the prompt or the temperature. It is the credential. This is why the security review of an agent should start with a list of tools and their scopes, and why that list should be short.
Least privilege is the principle and it is harder than it sounds. Teams grant broad scopes because narrow ones generate permission errors during development. The disciplined approach is to build read-only first, log which reads the agent actually performs, then add the smallest write that serves the use case, with an explicit approval path. A tool that takes a raw query or a free-form URL is effectively an unbounded credential, because the model chooses the target.
Model Context Protocol has made tool integration easier and, in some deployments, looser. A server that exposes twenty tools to any client that connects is a liability. Scope the key to a workspace, an agent and an environment, and treat MCP servers as production dependencies with owners, versioning and a way to revoke access quickly.
Failure modes worth designing against
Loops are the most common failure: the agent retries a step that will never succeed because the error is permanent, such as a missing field or a rejected template. Goal drift is the second: a long conversation gradually reinterprets the objective until the agent is optimising for a proxy, like closing a ticket quickly rather than resolving the issue. Silent success is the third and the most damaging, where the agent reports completion without verifying the system of record.
Prompt injection deserves separate treatment because agents read untrusted content. A customer email, a PDF attachment, a CRM note or a web page can contain instructions that the model may follow. The mitigation is architectural rather than linguistic: treat retrieved content as data, never as instruction, keep untrusted text out of the system prompt, require explicit confirmation for any action that follows a read of external content, and never let a tool call chain from a document directly into a payment.
The fourth failure is over-reach in scope: an agent built for one queue being pointed at another because the tooling made it easy. Scope is a policy object, not a prompt sentence. If the agent can be repointed by editing a configuration field, someone will repoint it during a busy week.
Evaluating the trajectory, not the reply
A single-turn eval asks whether the answer was good. An agent eval has to ask whether the sequence was acceptable: did it use the right tool, with the right arguments, in an order that a reasonable operator would accept? Two runs can end with the same message while one of them read a record it should not have touched. Grading only the output hides that.
A practical eval set has four parts. Golden tasks with a known correct end state. Adversarial tasks that tempt the agent to skip a gate or follow an injected instruction. Regression tasks drawn from real failures, one per incident. And cost tasks that check the run stays within its step and spend budget. Each task is scored on end state, tool trajectory, policy compliance and cost, with a human review of any run that fails trajectory but passes outcome.
Run the set before every prompt or model change, and keep the model version pinned so that a silent provider upgrade does not move the baseline. Evals are not a one-off validation exercise. They are the regression suite for a system whose behaviour is probabilistic, and they are the only way to move up the autonomy ladder with evidence rather than confidence.
Human oversight that is more than a rubber stamp
Approval queues decay. The first week, reviewers read every item. The fourth week, they click approve in two seconds because the queue is long and nothing has gone wrong yet. Oversight has to be designed against that tendency: sample rather than approve everything, vary the sample, and measure the reviewer’s agreement rate against a second reviewer so that a collapsing attention span is visible.
Gates work best when they are specific and rare. A gate on every message trains people to ignore gates. A gate on refunds above a threshold, bank detail changes, contract terms and anything a regulator would ask about keeps attention where it belongs. Each gate needs a named owner, a timeout, a default action and a reason code that lands in the trace.
Escalation is the other half. An agent that cannot escalate is not autonomous, it is trapped. The escalation path should carry a packet: verified identity, intent, what has been tried, what was promised, and a link to the trace. A human who has to restart the conversation will quietly stop trusting the agent, and the programme will stall for social reasons rather than technical ones.
The Indian compliance frame
Under the DPDP Act 2023, the entity that decides why personal data is processed is the data fiduciary, and it carries the duties: notice, consent, purpose limitation, retention, breach reporting and grievance redressal. An agent acting on customer data is doing so on the fiduciary’s instructions, which means the fiduciary cannot delegate the accountability to a model. The practical translation is that every agent run touching personal data needs a lawful basis recorded at the envelope, not inferred later from a chat log.
Consent has to be specific, and an agent that improvises a new use mid-conversation breaks that. If a customer opted in for order updates on WhatsApp, the agent may answer a delivery question and may not append a promotional offer, even if the offer is relevant. Purpose tags on tools enforce this mechanically. The same logic applies to voice recording: announce, capture the acknowledgement, and store the notice version with the consent event.
Sector rules add another layer. Payment and lending actions carry obligations that a general agent should not satisfy on its own, which is why money movement sits behind a gate and a system of record. SMS still runs through DLT registration, and voice campaigns respect do-not-disturb scrubbing and calling hours. None of this makes agentic AI impossible in India. It makes the gate and the trace non-negotiable.
What agency costs, and where the money goes
Agentic runs cost more than single-turn calls for an obvious reason: they make several model calls, and some of them are long. The cost drivers are the number of iterations, the size of the context carried between them, the price of the model used at each step, and the retries caused by tool errors. Routing is the main lever, because classification and extraction do not need the same model as negotiation.
The second lever is context discipline. Passing the entire conversation and every tool result into every step multiplies token spend and degrades attention. Summarising completed steps, keeping only the fields the next step needs, and caching stable instructions are engineering decisions with a direct effect on the invoice. LoopNow bills AI usage at ₹0.30 per thousand tokens on a mid-tier model, with plan allowances from 250 thousand to 20 million tokens, all exclusive of 18% GST.
The third lever is not using an agent at all. A deterministic workflow that handles the eighty percent common case and hands the rest to an agent is cheaper and easier to test than an agent that rediscovers the common case every time. The mature pattern is a workflow with agentic pockets, and it is less exciting than the demo, which is why it is under-used.
Worked example: a bounded collections agent
A Bengaluru equipment lender wants an agent to follow up on overdue invoices. The first version drafts reminders and a human sends them. After six weeks of clean traces, the agent is allowed to send reminders itself up to three per account, during working hours, in the customer’s preferred language, with a payment link. Any request for a settlement, any dispute, and any balance above a threshold goes to a human with a packet attached.
The loop reads the invoice, checks the last contact, chooses a template or composes one, sends through email or WhatsApp depending on consent, and schedules the next attempt. It stops after three attempts, on payment, or on any inbound reply that looks like a dispute. Every step is written to the trace with the invoice identifier, and the summary is written back to the accounting system so the next human sees the same facts.
The interesting design work was not the prompt. It was the stop conditions, the consent check before the WhatsApp path, the read-back of the amount, and the decision that a dispute freezes the sequence immediately. Those are business rules expressed as code, and they are what makes the autonomy defensible rather than merely impressive.
Frequently asked questions
Is agentic AI the same as generative AI?
No. Generative AI produces content in response to a prompt. Agentic AI uses a generative model inside a loop that plans, acts and observes results. A text generator with no tools and no state is generative but not agentic. The distinction matters because the risks, the costs and the testing approach all change once the system can act.
How is this different from an Agent OS?
Agentic AI is the capability; an Agent OS is the runtime that operates it. The OS supplies durable state, tool contracts, policy enforcement and traces across agents. You can build an agentic prototype without one, but production use tends to require the services an OS provides, or a home-grown equivalent maintained by your own team.
Does an agent need to be autonomous to be agentic?
No. Autonomy is a dial. An agent that drafts an action for approval is still agentic because it planned, acted and observed. Most valuable deployments sit at draft or act-with-approval, and the fully unsupervised rung is appropriate only for narrow, reversible, well-instrumented work.
What is the biggest failure mode?
Silent success, where the agent reports that something happened without checking the system of record. It is worse than an error because nobody investigates. The fix is to verify against the downstream system before reporting completion, and to treat an unverified completion as a failed run in the evaluation suite.
Can prompt injection be solved with a better prompt?
No. Injection is an architectural problem. Treat external content as data, never as instruction, keep it out of the system prompt, require confirmation when an action follows a read of untrusted text, and never allow a document to chain directly into a payment or a credential change.
How should an Indian team handle DPDP?
Record a lawful basis and a purpose on the run envelope, check consent before each channel action, keep personal data out of places you cannot delete from, and run a retention sweep across traces and vector memory. The data fiduciary remains accountable, so the agent’s evidence has to be good enough to answer a data principal’s request.
Do we need a human gate for every action?
No, and gating everything is counterproductive because reviewers stop reading. Gate the actions that are irreversible, high value or regulated, and let the rest run with limits, logs and sampling. A gate that nobody takes seriously is worse than no gate, because it creates the appearance of control without the substance.
How do you test an agent before launch?
With a fixed task set that scores end state, tool trajectory, policy compliance and cost, plus adversarial cases built from real injection attempts and regression cases from every incident. Run it before each prompt or model change, pin the model version, and review any run that reached the right answer by an unacceptable path.
What does an agent run cost in India?
It depends on iterations, context size and model routing. A multi-step run makes several calls, so it costs more than a single reply, and retries add to that. LoopNow bills AI usage at ₹0.30 per thousand tokens on a mid-tier model, exclusive of 18% GST, with plan allowances and a spend cap so a runaway loop is bounded.