Agentic AI: Definition, How It Works, and Real Examples

Agentic AI is AI that is handed a goal instead of a single question. It works toward that goal by planning steps, calling tools such as a search engine, an API or a CRM, checking what came back and deciding what to do next. What it produces is a change in some system: an edited file, an updated record, a sent message.

"Agentic" is the adjective of "agent": something that acts on someone's behalf. IBM's short definition is a good anchor. Agentic AI is "an artificial intelligence system that can accomplish a specific goal with limited supervision" (IBM). The two words that carry the meaning are goal and limited. Someone still sets the goal, and someone still decides how much the system may do without asking.

Disclosure: Customermates, an open-source CRM, publishes this guide. The worked example uses it; the definitions, patterns and risks apply to any agent.

How agentic AI works

Every agentic system runs a version of the same loop:

1. Goal. A person, a schedule or an event hands the agent a goal, such as "prepare a reply to this email" or "fix the failing test".
2. Plan. A language model breaks the goal into steps and picks the first one.
3. Act. The agent calls a tool: a search, a database query, an API call, a file edit.
4. Observe. It reads the result and compares it with the goal.
5. Continue or stop. It takes the next step, asks a person, or ends when the goal is met or a limit is reached.

IBM splits the same cycle into finer steps, from perception and reasoning through execution to learning and orchestration. What sets an agent's reach is its tools: a model without tool access can describe an action but cannot take it. That is why the Model Context Protocol, in its maintainers' words "an open-source standard for connecting AI applications to external systems", sits at the centre of so many agent setups.

How the main definitions differ

The main sources define agentic AI in slightly different words, and the differences show what each one cares about.

The shared core is a goal, tools, and some freedom in how to get there. The disagreement is about how much freedom.

Agentic AI vs. generative AI

Generative AI produces content: text, images, code, a summary. You read it and decide what to do with it. Agentic AI usually contains a generative model, but uses its output to choose an action and then takes it. IBM's example: generative AI can tell you the best time to climb Mount Everest, while an agentic system can also book the flights and the hotel.

The last two rows are the practical difference. A hallucination in a draft costs you an edit. The same hallucination inside an agent becomes a changed record or a sent email. So agents need permissions and approval rules that a text generator never needed.

Agentic workflows and AI agents

Anthropic's engineering guide separates workflows, "systems where LLMs and tools are orchestrated through predefined code paths", from agents, where the model directs its own process and tool use. Both count as agentic systems. The guide's advice is blunt: find the simplest solution that works, which "might mean not building agentic systems at all", and keep real agents for open-ended problems where you cannot predict the number of steps. I agree with it. Most business tasks that people call "agents" are better built as workflows with one or two AI steps.

The guide names five workflow patterns:

Agentic AI vs. AI agents. IBM describes agentic AI as a system that consists of AI agents, so "agentic AI" names the whole and "AI agents" the components. When several agents work together, each handles a subtask and an orchestration step coordinates them.

Examples of agentic AI in use

Each product below is called an agent by its own vendor, and the middle columns follow the vendor's documentation.

Outside software and sales, AWS lists uses such as shift scheduling, supply chain and inventory management, incident response and customer service.

A worked example: one narrow agent in a CRM

CRM work suits a first agent well. It repeats every day, the context sits in one place, and most changes can be corrected. Here is a concrete setup in Customermates, built as a routine: a saved instruction plus a trigger, run by Mate, the assistant in Customermates Cloud, using hosted AI credits.

What you need. Customermates Cloud on Pro or higher, because the trigger is an inbox event and the unified inbox starts at Pro. One connected email account (Gmail, Outlook or IMAP).

1. Create the routine

   Open Routines, click Add and give it a name, for example "Reply prep for active deals".

2. Choose the trigger

   Select When something changes and the event Email Received.

3. Write the instructions

   Paste the instruction below into Instructions. Keep the stop rule and the draft-only rule in it.

4. Read the first runs

   Open each run's details to see what triggered it, what Mate read and changed, and the credits it used. Adjust the wording until the drafts are ones you would send.

A new email arrived. Find the sender among my contacts.
If the contact is linked to a deal that is not in a won or lost stage:
1. Read the thread and the deal.
2. Append three lines to the deal's notes: what the sender wants,
   any date or amount they mention, and the open question.
3. Save a reply draft in the thread that answers what you can from
   the deal and its notes. Mark anything you are unsure about.
Do not send any message. Do not change the deal stage or value.
If the sender is not linked to an open deal, do nothing.

Why it is written this way:

• Draft-only has to be said. Mate sends emails and chat messages without a fresh approval when an instruction asks it to. A routine that should only draft must say so.
• Unattended runs cannot ask. In a chat, deletions and a few admin actions wait for your approval. In a routine nobody is there to answer, so those actions are declined and the run records the refusal.
• It runs as you. A routine runs as its owner, with that owner's access, connected channels and credits. An email the owner cannot see never starts a run.
• It cannot loop. Changes made by a routine run never trigger routines.
• Browsing and writing are kept apart. A run can search the web or change data, not both: once a web search has returned results, every write in that run is refused. Text from a web page cannot turn into a changed record in the same run.
• Spending is capped. Each run has a credit cap and each routine an hourly run limit. The current numbers are in the routines documentation, and the full approval list is in the Mate documentation.

What it costs. A three-person team on Pro pays €87 per month, at €29 per user. Each Pro user can keep 5 routines, and every active user gets monthly hosted AI credits; see pricing. A routine spends its owner's credits.

With your own AI client instead. Claude, ChatGPT and other clients work with the same records through MCP, started from the client rather than by an inbox event, and your AI provider bills the model use. MCP also works on a self-hosted installation, which has no inbox and no Mate. Two limits matter for agent design: an API key carries the full permissions of the user who created it, with no per-key scoping, and the server only asks clients to confirm before deleting or sending; whether they do is up to the client. The agentic CRM guide compares both routes.

The risks, and the controls that work

OWASP lists "Excessive Agency" in its Top 10 for LLM applications (LLM06:2025) and defines it as "the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM". The trigger can be a hallucination, a prompt injection hidden in content the agent reads, or a compromised tool. OWASP names three root causes, and each has a direct control:

Two more problems show up in practice. Errors cascade: if the first step misreads an email, every later step builds on the mistake. And cost grows with every step, which is why per-run limits exist.

Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027, citing escalating costs, unclear business value or inadequate risk controls. In the same release from 25 June 2025 it warns of "agent washing", the relabelling of assistants, chatbots and RPA tools as agents, and estimates that only about 130 of the thousands of vendors claiming agentic AI are real (Gartner). A quick test for any product sold as an agent: which tools can it call, with whose permissions, and what does it do without asking?

How to give an agent its first job

1. Pick a task with a clear end

   A good first task finishes in one run and has an obvious "done": a meeting brief, a reply draft, a cleaned-up record. Avoid open goals like "grow the pipeline".

2. Start with drafts and a narrow role

   Let the agent prepare and a person decide, and run it as a user whose role covers the task. Allow direct actions only for steps that are cheap to undo.

3. Write the stop rule

   Say what happens when a case does not fit: "If X, do nothing." Cases the instruction did not anticipate are where agents improvise.

4. Read every run at first

   Check the log of each early run. Widen what the agent may do one action at a time.

When agentic AI is the wrong tool

If the steps never change, a fixed rule is cheaper and more predictable than an agent. "When a deal moves to Won, create an onboarding task" needs a webhook and a workflow automation, not a language model. Agents earn their cost where the input varies: free-text emails, messy notes, questions that need several lookups. They are the wrong choice where a wrong action cannot be undone and nobody can review it in time, payments being the obvious case.

Agentic AI and data protection

Agents read personal data: names, email addresses, the content of conversations. Under the GDPR, a provider that processes that data on your behalf is a processor and needs a data processing agreement, and the AI providers it relies on are its subprocessors. For Mate in Customermates Cloud, the model providers are named in the subprocessors list. If you want to choose the provider yourself, connect your own AI client through MCP, or self-host the open-source core so the CRM data stays on your own servers.

Frequently asked questions

Third-party definitions, product descriptions and figures checked on 8 October 2026 against IBM, AWS, MIT Sloan, Salesforce, Anthropic, OWASP, the MCP documentation, the Claude Code documentation, GitHub Docs, OpenAI and Gartner.