A founder says “we have agents” and usually means one of three different machines. Mixing them up is how a chat window gets production credentials.
Three tests
Ask three questions of the system in front of you.
- Does it hold a goal that survives more than one prompt?
- Can it use tools (files, mail, a browser, a repo, a payment API) without you pasting the output back in?
- Does it continue across steps when a tool returns something messy?
If the answer is no, no, no, you have a chatbot. That is a respectable product. It is not an agent.
If the answer is no, yes, no, you have automation: a script with a model somewhere in the pipe. Also respectable. Still not an agent.
If the answer is yes, yes, yes, you have something that can act. Now the only question that matters is whether anyone wrote the ceiling down.
A fourth no is hidden in the yeses. Can it refuse a tool call? If it cannot stop, you do not have a worker. You have a fuse.
Chatbot, automation, agent
A chatbot answers a turn. You type. It replies. The context window is the memory. When you close the tab, the work is gone unless you saved it. Useful for drafting. Dangerous the moment you paste its output into a tool it cannot see.
An automation runs a fixed path. Ticket arrives, fields get filled, Slack pings. A model might classify the ticket. The path does not invent a new path. When it fails, it fails in a place you can find on a diagram. An agentic workflow is not an automation. A script that calls a model is still a script.
An AI agent takes a goal, chooses tools, and keeps going. That is the useful definition for operators. It is also the dangerous one. An agent that can mail, spend, or open a pull request is not “AI.” It is a junior hire with no employment contract.
Walk one object through the three boxes. “Summarise this PDF in the chat” is a chatbot. “When a PDF lands in this folder, extract the invoice total into the sheet” is automation. “Chase unpaid invoices this week, using the sheet and the mail tool, and stop if a customer disputes” is an agent, but only if someone wrote the stop.
The glossary capsule is the short form. This page is the test you run in a meeting.
The charter is the definition
I do not call a system an agent until it has a written charter. Seven fields, the same ones I use for human operators in CHORUS:
- purpose
- inputs
- outputs
- authority ceiling
- success criteria
- review requirement
- escalation
If you cannot fill those fields, you do not have an agent. You have a demo. Demos are allowed. Demos do not get the production key.
Filled, for the invoice worker:
- Purpose. Collect overdue invoices this week without starting a legal fight.
- Inputs. The receivables sheet dated today. The last approved reminder template.
- Outputs. A send-ready draft per overdue row, or a skip with a reason.
- Authority ceiling. Draft only. No send. No new discount. No promise of legal action.
- Success criteria. Every draft names the invoice number and the true amount. A skip is valid if the row is disputed.
- Review. Founder fails any draft that invents a fee or changes due date.
- Escalation. Anything that looks like a dispute goes to the founder before a second draft.
That is seven fields. Not six (that is a handoff packet). Not four (that is a slogan). The CHORUS Charter line is the same list for a human or an agent.
The human in the loop is not a person glancing at a dashboard. It is a named reviewer who can fail the output against the success criteria. No named reviewer, no loop.
The override doctrine is the other half of the charter. The charter says what the agent does. The doctrine says what it must refuse: spending above a ceiling, speaking as the company, changing production data, closing a judgment you still own.
MCP is how that worker is allowed to touch the building: visibility, mutation, log. It is not the definition of the worker. A clean server with no charter is still a hole with nicer plumbing.
Where this sits in the library
SENSE decides where an agent belongs in a founder’s week: which signal is worth a standing system, which claim needs a confidence grade, which Monday decision changes. The 90-day calendar is Diagnose, Deploy, Evaluate. AI Agents for Startup Strategy is the book that installs that layer.
Why multi-agent systems fail is what happens when you add three of these workers and skip the protocol. Capability is cheap. Coordination is not.
STACK is the next door. Once you have a real agent, the repo it lives in starts to rot unless the agent OS is versioned like the app. That is a different article.
This page does not sell a runtime. Runtimes change names. The three tests and the charter do not.
A five-minute audit
Pick one system you already call an agent.
- Write the goal in one sentence that still makes sense tomorrow.
- List the tools it can touch. If “whatever the plugin list is” is the answer, you do not have a list.
- Name the human who can stop a call. A role is not a name.
- Write the one action it is forbidden to take.
- Write the last time that human actually failed an output.
If any line is blank, stop using the word agent for that system until the line is filled. The vocabulary is the control. Loose vocabulary is how a chatbot inherits an API key.