While an assistant answers and leaves you to decide what to do with the answer, an agent acts. It sends the email, updates the record, books the meeting, moves the file and carries on through several steps without asking at each one. The tools your people already use are adding agent features, which changes three things about how you control them.
Three things change
| An assistant | An agent | |
|---|---|---|
| The question to ask | What it can see | Also what it can change and send |
| A wrong answer or action | Caught when a person reads it | Has already happened by then |
| A malicious email | Produces a strange answer | May act on it |
Access becomes action
With an assistant, the question was what the tool could see, which is the question in what Copilot can already see. With an agent, the question is also what it can change and what it can send. An agent that acts on a person's behalf can usually do whatever that person's account can do, and most accounts can do far more than any one task needs.
Mistakes land before anyone reads them
With an assistant, a wrong answer can still be caught when a person reads it. An agent's wrong action has already happened by then: the email has gone, the record has changed, the meeting is in a client's calendar. The review step that protects you with an assistant has to move to before the action, and somebody has to decide which actions need it.
Instructions can come from the content
To do its work, an agent reads emails, documents and web pages, and any of them can contain text written to look like an instruction. The Open Worldwide Application Security Project ranks this, known as prompt injection, first in its 2025 list of risks for applications built on language models. Among its other entries is giving a model more capability than it needs, which it calls excessive agency.
An assistant that reads a malicious email produces a strange answer, whereas an agent that reads one may act on it. AI security covers why a filter alone cannot stop this. AI browsers carry the same risk onto every page a person opens, because they read each one and can act inside that person's logged-in accounts, as AI browsers at work sets out.
A check on the excitement
Gartner predicted in 2025 that more than 40% of agentic AI projects would be scrapped by the end of 2027, because of escalating costs, unclear business value or inadequate risk controls. It also warned that many products sold as agents are existing assistants and automation renamed.
So the first question about any agent is what it does on its own, step by step, and whether a plain workflow would do the same job more reliably. Often one would, and where AI helps is explicit about the candidates where that is the better answer.
Five questions before an agent goes live
- What can it do, beyond what it can see? Write down every action it can take, start with none of them switched on and enable each one only when the task needs it.
- Whose identity does it act under? When an agent runs as a person, it inherits everything that person can do. An agent with its own identity can be given narrow permissions and leaves a record that is clearly its own.
- Where does a person approve? Anything that leaves the business, moves money, deletes something or changes a client record should wait for a named person to approve it, and the approval should be recorded.
- What does it read that someone outside the business could have written? Emails, shared documents and web pages are all routes for instructions you did not give. If an agent reads outside content, it should not also hold the power to send, pay or delete.
- How do you see what it did, and how do you stop it? Every agent needs an owner, a log of its actions and a way to switch it off at once. Some agents are also billed by use, so someone should watch what they cost.
Where to start
For a first agent, the safest choices are internal, reversible and narrow. Drafting replies into a folder for a person to send, sorting incoming requests into suggested queues or tidying a spreadsheet with a person approving the result all fit. Each one saves time while a mistake costs a few minutes to undo.
What goes into the policy
An agent is a tool on the register like any other, with three additions: the list of actions it may take, the actions that need a person's approval and the named owner who answers for it. The governance framework has room for all three without a separate process. For agents built in Microsoft 365, Copilot Studio and Copilot agents sets out the decisions in full.
Where this fits
An agent is something you build and run rather than switch on. In our route that is Build, where Discover decides whether an agent or a plain workflow is the right answer. Make then builds it into the systems you already run, and Test checks it against your own work before anyone relies on it. The permissions review in Guardrails comes first, and Trackside keeps it running and watched afterwards.