What are AI agents, and when should you use one?

You need to compare two workplace policies before a team updates its handbook. One file covers remote work; the other covers hybrid office attendance. The documents use different headings, overlap on expenses, and disagree about who approves exceptions.

This task has a clear output but a variable path. An agent can inspect both files, decide which clauses relate, build a cited comparison, and stop when language conflicts. The safest first version remains read-only and produces a draft for human review.

Define an agent by its decisions and actions

An artificial intelligence (AI) agent receives a goal, observes a state, chooses a next action, uses a tool, and evaluates the result. The loop continues until it reaches success, a limit, a failure, or a human approval boundary. That differs from one model response because later steps depend on earlier observations.

Google's agent glossary describes agentic software as reasoning about input to plan and execute actions on a person's behalf. OpenAI groups the core around a model, tools, and instructions. In practice, permissions, state, guardrails, evidence, and exit conditions make those parts operable.

“Autonomous” does not mean unrestricted. An agent should act only inside the action space you define. For our comparison, that space includes reading two named documents and writing one draft table, not editing policies or emailing employees.

Choose an agent only when the path can vary

Use a fixed workflow when the steps are known in advance. A scheduled export that reads six columns, creates a file, and stores it in one folder does not need a model to choose its path. Code can perform that sequence with lower cost and a smaller failure surface.

The policy comparison contains variable work. The agent must find differently named sections, connect clauses that express similar rules, and notice missing or conflicting information. Its choices remain useful only when each claim can be traced back to the source.

Anthropic distinguishes workflows, where code determines the route, from agents, where a model directs its process and tool use. Begin with the less flexible design that meets the need. Add an agent loop when adaptation produces a result you can verify.

Turn the policy task into a bounded goal

Write the expected artifact before granting tools. Our output is a table with rows for work location, required office days, core hours, equipment, travel expenses, exceptions, and approval. Every cell must cite a page, heading, or stable clause reference.

State what the draft must do when evidence fails. If one policy lacks a rule, write “Not stated” and cite the searched section. If two clauses conflict, quote neither at length; cite both, label the conflict, and request a decision.

The assignment can follow the structure from your first good prompt:

Goal: Compare the approved remote and hybrid work policies.
Inputs: Read only policy-remote.pdf and policy-hybrid.pdf.
Output: A cited table covering seven named policy topics.
Rules: Never edit source files. Do not infer missing policy.
Write only to drafts/policy-comparison.md.
Stop: Ask for review when clauses conflict or a file is unreadable.
Limits: 20 tool calls and no external network access.

The request names data, actions, output, and stop conditions. It also prevents a tidy table from hiding uncertainty.

Grant the minimum tools and permissions

Start with read access to the two files. Grant write access only to the draft path if the agent must save its table. Do not provide broad drive access, messaging tools, policy edit rights, or administrator credentials.

Least privilege limits the cost of a wrong action and the reach of malicious instructions. A policy file could contain text that tells an automated reader to upload documents or ignore prior rules. The agent must treat document contents as data, not as authority to expand its task.

Keep secrets outside the prompt and tool output. If a connector requires credentials, use the platform's protected credential mechanism and scope the account. The model should never need to see a reusable password to compare two files.

Follow the observe, act, and verify loop

On its first observation, the agent inventories both documents and their headings. It then searches for the seven topics and records candidate clauses with source locations. This intermediate evidence should remain available for review.

The action step converts matched clauses into one table row at a time. After each row, verification checks that the wording stays within the cited evidence. A missing citation, unsupported interpretation, or conflict prevents that row from being marked complete.

The agent repeats the loop until all topics have a supported value, an explicit “Not stated,” or a flagged conflict. It then stops and reports the draft path, source coverage, unresolved items, and limits reached. It does not publish the table or change either policy.

Defend the loop against manipulated content

The National Institute of Standards and Technology (NIST) reports indirect prompt injection as an agent security concern. Malicious text can appear inside web pages, email, files, or repositories and attempt to redirect tool use. Strong system instructions help, but technical permissions provide the firmer boundary.

Allow only known file paths and tools. Validate every requested destination outside the model, cap steps and cost, and log tool calls. Require approval for any action that sends, deletes, publishes, pays, changes access, or exposes confidential material.

Guardrails reduce risk without proving safety. A permitted action can still be wrong, and a cited source can still be outdated. Human review remains necessary when the result affects employment rules or other consequential decisions.

Keep human approval at policy boundaries

Suppose one file says managers approve remote-work exceptions while another assigns approval to People Operations. The agent should not select the newer-looking sentence unless you defined a reliable precedence rule. It should cite both clauses and ask an accountable owner to resolve them.

Approval is also required before distributing the comparison. A reviewer should inspect citations, source versions, omissions, and the handling of conflicts. The final publication process should use the organization's normal document controls rather than an agent's broad send permission.

This distinction mirrors responsible vibe coding. The model can perform substantial work, but a person defines correctness and accepts the outcome.

Decide whether several agents help

One agent can compare both policies with fewer handoffs. Splitting extraction and review between two agents may add an independent check, but only when their inputs and outputs are explicit. Two agents sharing one draft can overwrite evidence or reproduce the same mistaken assumption.

If you parallelize, give each agent an isolated artifact. One can extract clauses from the remote policy while another extracts from the hybrid policy. A separate comparison step then joins their cited outputs and flags mismatches.

Do not use multiple agents to compensate for unclear ownership. More roles add cost, context boundaries, and integration work. Start with one bounded run and split only after measuring a specific bottleneck or error pattern.

Check the agent before accepting its report

Use this list for the read-only policy comparison:

• The goal names the seven comparison topics and the required table format.
• Tools can read only the two approved source files and write only one draft.
• Every table value has a source location or an explicit “Not stated” marker.
• Conflicting clauses remain flagged for human approval instead of being resolved silently.
• Tool calls, step limits, cost limits, failures, and final status are visible.
• No source file, permission, message, or published policy changed during the run.
• A responsible policy owner reviews the cited draft before distribution.

An effective agent is a bounded decision loop with observable evidence. The policy example works because read access, output, limits, and approval are explicit. Remove those controls and the same flexible behavior becomes difficult to trust.