What an AI agent is
A chatbot answers with text. An agent also uses tools: it searches your documents, calls an API, writes to a database or sends mail. That is what makes it useful and what makes it risky, because it no longer only says things, it does them.
Inside a company they usually appear attached to something that already exists: the internal search, the CRM, the messaging tool. That is where they inherit permissions nobody reviewed.
Types of AI agents
Textbooks classify them by how they decide: reflex, goal-based, learning. Inside a company it is more useful to classify them by what they can do. A tool-using assistant answers and queries systems when asked. A workflow agent runs a multi-step task on its own, such as sorting mail and opening tickets. And in multi-agent systems one agent plans and others execute, which is what is usually called agentic AI.
The more autonomy, the more it matters what it can touch. An assistant that only reads is a data risk; an agent that writes, sends or pays is also a money and reputation risk.
Examples of AI agents in a company
Customer service: it answers from the knowledge base and opens the case in the CRM. Sales: it summarises calls and updates opportunities. Engineering: it writes changes and opens pull requests. Data: it answers business questions by querying the data warehouse. Operations: it reads alerts, looks for the cause and proposes the fix.
Every one of them raises the same question: with which permissions does it act, and who sees what it does. A support agent that can read every case can return another customer case; a data agent querying with admin rights answers what the person asking should not see.
What can go wrong
Three things repeat. First, it hands a person data that is not theirs, because the agent sees more than the person asking. Second, prompt injection: a text hidden in a document or a web page changes its instructions. Third, it acts too far: it deletes, sends or pays without anyone approving.
None of the three shows up in the demo, because there the document is yours, the question is friendly and the volume is three files.
What we review before it runs alone
What data it can read and return, and to whom; which tools it may use and with what spending and usage limits; its resistance to prompt injection, tested by hand with the cases someone abusing it would use; what is logged for each decision; and what happens when the model changes, which is what nobody looks at again.
That review is the AI governance one when we talk about the whole picture, and the backend and API one when we talk about the system the agent lives in.