Short answer: A chatbot answers when someone asks. A workflow runs steps you set in advance, with a model reading or writing inside some of them. An agent gets a goal and decides its own next step. For most business processes, use a workflow, add an agent step only where the path cannot be planned, and keep a person approving.
A chatbot or assistant answers when someone asks. An AI workflow runs steps you defined in advance, with a model doing the reading or writing inside some of them. An AI agent is given a goal and decides its own next step, using tools such as your CRM or inbox until the job is done. For most business processes today, the right answer is a workflow, with an agent step only where the path cannot be planned, and a person approving before anything important happens.
Below: the definitions, a comparison table, four business examples, the risks, and eight questions for any vendor who says “agent”.
What is the difference between an AI agent, a chatbot and a workflow?
Ask one question: who decides what happens next?
Chatbot or assistant. A person asks, the model answers. It may look things up in approved documents, but then it waits for the next question and takes no action itself. Gartner describes AI assistants the same way: they simplify tasks, but depend on human input and do not operate on their own. That also settles “AI agent vs assistant”: an assistant waits for you, an agent carries on without you.
AI workflow. Software runs a fixed sequence: an email arrives, is classified, fields are extracted, a record is checked, a reply is drafted, a person approves. The model works inside some of those steps, and the sequence runs the same way every time. Anthropic, in Building effective agents, defines workflows as systems in which models and tools follow code paths written in advance.
AI agent. The model gets a goal and a set of tools. It picks a tool, looks at the result, decides what to do next, and repeats until it is done or hits a limit. Anthropic defines agents as systems in which the model directs its own process and tool use.
OpenAI’s practical guide to building agents draws the line in the same place: an agent uses the model to run the workflow and choose tools as it goes, and applications that use a model without letting it control the steps, such as simple chatbots, are not agents.
What is an AI agent in simple terms?
The shortest definition we know comes from developer Simon Willison, who crowdsourced more than 200 definitions before settling on one: “An LLM agent runs tools in a loop to achieve a goal.” The loop is the point: a chatbot answers once, a workflow runs once along its track, an agent keeps going and chooses as it goes.
AI agent vs chatbot vs workflow: the comparison table
Question | Chatbot or assistant · Workflow · Agent |
|---|---|
Who decides the next step? | The person asking · Your process design · The model |
What starts it? | A question · An event, such as an email, form or file · A goal, from a person or a workflow |
Does it act in other systems? | Rarely; it answers · Yes, in the steps you allowed · Yes, with whichever allowed tool it picks |
How predictable is it? | Wording varies, no actions · Same path every time · Path differs per case |
Cost per case | Low · Low and steady · Higher and variable |
Audit trail | A chat log · The same steps logged every time · Must be designed in: every tool call and decision |
Best for | Questions on approved content · High-volume, repeatable processes · Open-ended, lower-volume tasks with a person reviewing |
Main risk | Wrong answers believed · Rigid when a case does not fit · Compounding errors, cost overruns, misused tools |
The cost and risk rows follow the builders’ own warnings: Anthropic notes that agentic systems trade speed and cost for better results, and that agents’ autonomy brings higher costs and the potential for compounding errors.
AI agent vs agentic AI: are they the same?
Not quite. Lawyers at Debevoise & Plimpton, writing for the Harvard Law School Forum on Corporate Governance, separate three terms: an AI agent is a single goal-directed system, AI agents are several of them, and agentic AI is the broad category of AI that acts toward goals on its own.
Anthropic uses “agentic systems” even more widely, as an umbrella for both workflows and agents. So “agentic” on a product page can mean anything from a fixed workflow with one model call to a fully autonomous agent. Ask which.
Gartner has a name for the stretch: agent washing, the rebranding of existing assistants, robotic process automation or chatbots as agents without real agentic capability.
In June 2025 it estimated that only about 130 of the thousands of vendors selling agentic AI were real, and predicted that over 40% of agentic AI projects will be canceled by the end of 2027 because of rising costs, unclear value or weak risk controls. In August 2025 it called the habit of referring to assistants as agents the most common misconception in the market.
Agents are not a fad, though. In the same release, Gartner predicted that by 2028 at least 15% of day-to-day work decisions will be made autonomously through agentic AI, up from zero in 2024.
When is each one the right choice for a business?
Five factors decide it. The more of them matter to a process, the further you should stay from full autonomy.
Predictability. If the same input must always get the same handling, use a workflow. OpenAI’s guide reserves agents for complex judgment, rules too tangled to maintain, or heavy reliance on unstructured input, and says that otherwise a deterministic solution may be enough.
Cost. In Anthropic’s own data, agents used about four times as many tokens as chat interactions, and systems of several agents about fifteen times. At a few cases a week that hardly matters. At thousands a month it does.
Risk. If a wrong action is costly or cannot be undone, a person approves it, whichever design you choose.
Audit trail. A workflow logs the same steps every time, which is easy to explain to an auditor or a client. An agent leaves a different trail for every case.
Volume. High volume favors fixed steps you test once and run thousands of times. Varied, lower-volume work is where an agent earns its cost.
Gartner analyst Anushree Verma put the division of labor in one line: “They can start by using AI agents when decisions are needed, automation for routine workflows and assistants for simple retrieval.”
A decision table you can use in a meeting
If the job looks like this | Use |
|---|---|
People ask questions about approved content, and a person reads the answer | Chatbot or assistant |
The same steps every time, high volume, a record needed | Workflow |
The path depends on what it finds, lower volume, a person reviews the result | Agent |
Mostly the same steps, but some cases need digging | Workflow with an agent step |
An action that is irreversible, regulated or leaves the company | Any of the above, with a person approving first |
Which one fits? Four business examples
These are composite examples to show the choice, not client cases.
1. Supplier invoice matching: a workflow. The workflow extracts the invoice fields, matches them against the purchase order and goods receipt, and flags any difference above the agreed tolerance. The steps never change, volume is high, and finance needs a record of every match. The model reads, the rules decide, and a person approves payment of anything flagged.
2. Customer enquiries at a consumer health brand: a workflow with an agent step. Emails are classified, the order is looked up, and a reply is drafted from approved product information. A few cases, such as a parcel lost between two carriers, need investigation. There, an agent step checks the shop system, the carrier’s tracking and earlier emails, then hands a summary and a draft back to the workflow. A person approves every reply that mentions health, safety or a refund.
3. A research assistant for the sales team: an agent. Before a first call, a salesperson asks for a brief on a prospect. The path differs every time: website, news, annual reports, CRM history. Nobody can predict the number of steps, which is where Anthropic says agents fit. This agent only reads, its output goes to one person, and a wrong detail costs a sentence, not a contract.
4. Procedure questions in a clinic or lab: an assistant. Staff ask how to log a sample or handle a complaint. The assistant answers from the approved procedures, cites the section and takes no action. The risk is a wrong answer believed, so every answer links its source and anything clinical goes to a named person.
The pattern: the more a system acts on the outside world, the more fixed steps and approvals surround the model.
Why are most valuable business systems workflows with an agent step?
The fixed track carries the volume and the audit trail. The agent step handles the cases the track cannot. The approval point catches what both get wrong. The evidence points the same way:
In Salesforce AI Research’s CRMArena-Pro benchmark of realistic sales and service tasks, leading agents succeeded about 58% of the time on single-turn tasks and about 35% when the task ran over several turns. Workflow execution was the easiest skill, above 83% single-turn for the best agents. The models tested were those available in spring 2025 and have improved since, but the shape holds: the more open-ended the task, the lower the success rate.
Gartner’s 2026 Hype Cycle for Agentic AI, published in April, puts agentic AI at the Peak of Inflated Expectations. Only 17% of organizations had deployed agents, most deployments remain narrowly scoped, and Gartner says fully autonomous agents are not ready for most enterprise use cases.
In a survey of 603 technology decision-makers by Harvard Business Review Analytic Services, in a report sponsored by automation vendor Workato, only 6% said they trust agents to run core end-to-end processes on their own.
McKinsey’s 2026 State of AI survey found chatbots the most widely scaled AI tool, at 47% of respondents, against about two in ten for agents. Outside large companies (over $1 billion in revenue), the share scaling agents stayed essentially flat at 22%. Both surveys are self-reported.
Gartner’s May 2026 guidance offers a useful ladder of four autonomy levels: observe (read only), advise (drafts that people act on), act with approval (each action approved by a person), and act autonomously. For most business processes today, we would start on the middle two rungs.
Gartner warns that approvals degrade under time pressure and approval fatigue, and predicts that by 2027, 40% of enterprises will demote or decommission autonomous agents over governance gaps found only after incidents. We cover how to keep approvals meaningful in where to put human approval points.
What are the risks of AI agents?
Three matter most for a CEO.
Errors compound over steps. Each step builds on the one before. A simple illustration, not a measurement: if each step is right 95% of the time and errors are independent, a ten-step task comes out fully right about 60% of the time (0.95 to the power of 10).
At 98% per step, about 82%. Real agents catch some of their own mistakes, but Anthropic’s engineers write that agents keep state and their errors compound, so without safeguards a minor failure can become a serious one. Checks against real results between steps, and a person at the end, break the chain.
Costs blow up. An agent that loops or retries can burn through a budget before anyone notices. The OWASP Top 10 for LLM Applications 2026 moved unbounded consumption up four places and calls for hard spending caps that halt the system, not alerts that a fast workload can outrun. Anthropic describes stopping conditions, such as a maximum number of iterations, as the common way to keep control. In McKinsey’s survey, about one in ten respondents said costs already constrain their use of chatbots, agents or coding agents.
Security: prompt injection and excessive agency. A model cannot reliably tell instructions from data, so a supplier email, web page or PDF can carry hidden text that tells an agent to do something else. OWASP keeps prompt injection as the top risk in its 2026 list and moved excessive agency (more tools, permissions or autonomy than the job needs) up to third, because practitioners and the incident record both point to agentic deployments as where the damage lands.
Its mitigations read like a design brief: least privilege for every tool, credentials held in code rather than handed to the model, and human confirmation before any irreversible or externally visible action. It also adopts Meta’s Rule of Two: a system that reads untrusted content, can reach sensitive data, and can change records or communicate externally needs a person’s approval for every action. For systems that act on their own, OWASP adds a separate Top 10 for Agentic Applications.
A workflow narrows these risks: fewer tools per step, fewer paths, every path tested before go-live.
What should you ask a vendor who says “agent”?
Show me the loop. Which steps are fixed, and where does the model choose? If it never chooses, it is a workflow. That is fine, but it should be priced and tested like one.
Which tools can it use, with which permissions? Read only, or can it write, send, pay or delete? Which actions wait for a person?
What stops it? A maximum number of steps, a time limit, a spending cap per case and per month. What happens when it hits one?
What does it log? Every tool call, input, output and approval, including who approved, in a form we can export.
How was it tested, and on whose data? Ask for the success rate on a set of your own past cases, not a demo.
How does it handle untrusted content? Emails, uploads and web pages. Does any step combine untrusted input, sensitive data and the ability to send or change things?
What does one case cost at our volume, and how much does that vary? Ask for the worst month, not the average.
Who owns the prompts, the test cases and the configuration, and can we swap the model? We cover this in Build or buy AI?.
A vendor with a real agent answers these quickly and specifically. A vendor who is agent washing talks about autonomy instead.
Where to start
Write one process down as steps. Mark the steps that are always the same, the steps that need reading or writing, and the cases that need someone to dig. The first become a workflow, the second get a model, the third may justify an agent step. Then put a person in front of every action that leaves the company.
That is how we build at Postmodel: workflows inside the tools your team already uses, an agent step only where the path cannot be planned, and approval where it matters. Projects start at €10,000 (from $12,000 in the US). Being sold an agent? Book a fit check and we’ll tell you whether a workflow would do the job. Next, read Build or buy AI? and how to choose your first AI workflow.
Frequently asked questions
What is an AI agent in simple terms?
The shortest definition we know is Simon Willison’s: an LLM agent runs tools in a loop to achieve a goal. A chatbot answers once, and a workflow runs once along its track. An agent keeps going and chooses its next step as it goes.
Is agentic AI the same as an AI agent?
Not quite. An AI agent is a single goal-directed system, while agentic AI is the broad category of AI that acts toward goals on its own. Anthropic uses agentic systems as an umbrella for both workflows and agents, so ask any vendor which one they mean.
When is a workflow better than an AI agent?
When the same input must always get the same handling, when volume is high, when you need the same audit trail every time, or when a wrong action is costly. Agents earn their cost on varied, lower-volume work where nobody can predict the number of steps.
What are the main risks of AI agents?
Errors compound over steps, costs can blow up when an agent loops or retries, and prompt injection lets hidden text in an email or web page steer it. Checks between steps, hard spending caps, least privilege for every tool and a person before irreversible actions reduce those risks.
What should you ask a vendor who sells an AI agent?
Ask to see the loop, which tools it can use with which permissions, and what stops it. Ask what it logs, how it was tested on your own past cases and how it handles untrusted content. Then ask what one case costs at your volume, and who owns the prompts and test cases.
Related reading
Sources
Anthropic. “Building effective agents.” Erik S. and Barry Zhang. December 19, 2024. https://www.anthropic.com/engineering/building-effective-agents
OpenAI. “A practical guide to building agents.” 2025. https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
Simon Willison. “I think ‘agent’ may finally have a widely enough agreed upon definition to be useful jargon now.” September 18, 2025. https://simonwillison.net/2025/Sep/18/agents/
Gartner. “Gartner Predicts 40% of Enterprise Apps Will Feature Task-Specific AI Agents by 2026, Up from Less Than 5% in 2025.” Press release, August 26, 2025, updated September 5, 2025. https://www.gartner.com/en/newsroom/press-releases/2025-08-26-gartner-predicts-40-percent-of-enterprise-apps-will-feature-task-specific-ai-agents-by-2026-up-from-less-than-5-percent-in-2025
Charu Chandrasekhar, Ben Pedersen and Paul Rodel (Debevoise & Plimpton). “Agent Washing: Disclosure Risks in the Emerging Market for AI Agents.” Harvard Law School Forum on Corporate Governance, April 16, 2026. https://corpgov.law.harvard.edu/2026/04/16/agent-washing-disclosure-risks-in-the-emerging-market-for-ai-agents/
Gartner. “Gartner Predicts Over 40% of Agentic AI Projects Will Be Canceled by End of 2027.” Press release, June 25, 2025. https://www.gartner.com/en/newsroom/press-releases/2025-06-25-gartner-predicts-over-40-percent-of-agentic-ai-projects-will-be-canceled-by-end-of-2027
Anthropic. “How we built our multi-agent research system.” June 13, 2025. https://www.anthropic.com/engineering/multi-agent-research-system
Kung-Hsiang Huang et al. (Salesforce AI Research). “CRMArena-Pro: Holistic Assessment of LLM Agents Across Diverse Business Scenarios and Interactions.” arXiv:2505.18878, May 24, 2025. https://arxiv.org/abs/2505.18878
Gartner. “What the 2026 Hype Cycle for Agentic AI Reveals.” Rajesh Kandaswamy, April 15, 2026. https://www.gartner.com/en/articles/hype-cycle-for-agentic-ai
Harvard Business Review Analytic Services. “2025 HBR Enterprise Agentic AI” report, sponsored by Workato. Survey of 603 technology decision-makers. https://www.workato.com/full-reports/2025-hbr-enterprise-agentic-ai
McKinsey & Company. “The state of AI in 2026: On the road to ROI.” August 25, 2026. https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
Gartner. “Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure.” Press release, May 26, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure
OWASP GenAI Security Project. “OWASP Top 10 for LLM Applications 2026.” August 2026. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
OWASP GenAI Security Project. “OWASP Top 10 for Agentic Applications.” December 9, 2025. https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/