Understanding AI agents.

Goal: Understand what turns an AI tool into an agent, then watch one complete a low-risk task and map every action it took. Who it is for: Business owners, managers and staff who keep hearing “agentic AI” and need to judge vendor claims or decide whether to try an agent themselves. Time: 30 minutes, plus an AI assistant with web access, ideally with an agent or research mode.

In September 2026 the OWASP GenAI Security Project published its updated Top 10 risks for LLM applications, and its biggest move was “excessive agency” climbing to third place. The reason is simple. Once AI systems can call tools, the question stops being “is this answer right?” and becomes “what did it just do?” Understanding agents starts with that shift.

What makes something an AI agent

An AI agent is a model that decides and acts in a loop. The joint guidance co-authored by New Zealand’s NCSC, Careful adoption of agentic AI services (1 May 2026), describes agentic systems as relying on “an AI model, such as an LLM, to interpret and reason about the state of the world, make decisions and take actions”, alongside external tools, data sources, memory and planning. In practice, four ingredients:

Compare that with tools you already know:

Exercise: watch an agent work and map its actions

1. Choose a low-risk, read-only task. Research on public websites is ideal: no logins, no messages sent, no bookings, no payments.
2. Run it in an agent or research mode. Several assistants offer these on some plans, under names that change often. If yours does not, run a manual version: ask the assistant to plan each step and tell you which search to run, then paste the results back.
3. Log every step. Write down each thing it searched, opened or tried, and where it stopped or got stuck.
4. Map the actions. Build a table: action, data touched, reversible or not, and who would need to approve it if this were real.
5. Add one permission in your head. Imagine it can now send enquiry emails and pay deposits. Mark which rows change and where approval must sit.
6. Note one wrong or overconfident step. Every agent run has one. Finding it is the skill.

Worked example: shortlisting workshop venues

Illustrative example: a 15-person Wellington software consultancy planning a half-day client workshop for 40 people. The business is fictional.

Find three Wellington CBD venues that can host 40 people for a half-day
workshop on a weekday in late November 2026, with a screen and catering.

Rules:
- Use public websites only. Do not contact, enquire, book or pay.
- Show me your plan before you start.
- Keep a numbered log of every search and page you open.
- For each venue give capacity, facilities, contact page and source links.
- List what you could not confirm, especially availability and price.

Example output (illustrative, abridged):

Plan: search venue directories, then confirm each venue on its own site.
Log:
1. Searched "Wellington CBD meeting venue 40 people"
2. Opened a directory listing (capacity figures not dated)
3. Opened Venue A's own site: boardroom seats 40 classroom style
...
9. Venue C's site lists capacity 60, catering "on request"
Could not confirm: availability for any date; prices for two venues.
Note: the directory said Venue B seats 50; its own site says 36.

Now map it:

The log matters as much as the shortlist. It shows the agent caught a directory listing that contradicted the venue’s own site, which is the kind of check you want, and it shows exactly what you would be trusting if it were allowed to send emails.

Where AI agents go wrong

• Excessive agency. OWASP traces it to excessive functionality, excessive permissions or excessive autonomy. Give agents only the tools and access the task needs.
• Instructions hidden in content. A web page, document or email can contain text aimed at the agent. NCSC gives the example of malicious prompts in phishing emails aimed at email-monitoring agents.
• The confused deputy. NCSC describes a low-privileged user manipulating a high-privileged agent into doing what the user could not do directly. Agents should not hold more access than the people using them.
• Loops and cost. Agents can repeat steps, run up usage costs or never finish. Set step and spend limits.
• Volume without quality. On GTM-Bench, a 72-task benchmark co-authored by Levy Street team members, many generalist agents scored negatively because weak results counted against them.

The NCSC guidance is direct: organisations “should only use agentic AI for low-risk and non-sensitive tasks”, and decisions about when human approval is required should be made by system designers or operators, “not delegated to the agentic AI system”. Our Property Management Agent for APL Property follows that pattern: an internal agent that automates core administrative work while staff keep the decisions. For the design side, see designing reliable AI agents and the AI agent acceptance checklist. To compare approaches, read automation versus AI agents, and when a business process needs an agent built properly, our AI agent development team does that work.

Self-check

• You can name the four ingredients of an agent: model, tools, permissions, loop.
• You ran a read-only task and logged every step the agent took.
• Your action table records data touched, reversibility and approval for each action.
• You identified which actions would need human approval if permissions were added.
• You found at least one wrong or overconfident step in the run.
• You can explain why NCSC advises agents only for low-risk, non-sensitive tasks.

Next lesson: When a workflow does not need an agent.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.