Select a result to preview

Agentic AI

P: Let’s take some time to learn and understand what Agentic AI is.
Me: Dude, we already know what AI is. We can do prompt injection and see what’s going on.

This was a conversation between my coworker and me when we got assigned to work on agentic AI. Almost always, I like to jump the gun and start doing things. There are times and places where that works, but on many occasions, it’s led me more toward “lessons learned” than “significant results.”

Fast forward: I’m so glad I took the time and effort (and followed my coworker’s direction) to actually learn what agentic AI is. I mean, it’s similar to what we already know, but there are some huge differences between “AI agents” and “agentic AI” that I honestly never understood before.

BLUF / Key Takeaway

So what did I learn?

Agentic AI extends generative AI from content creation to goal execution.

It can autonomously plan, decide, and act across tools and systems, making it powerful, while simultaneously expanding security, governance, and blast-radius risk.

Agentic AI. Clear Technical Overview

Agentic AI refers to a class of AI systems that can autonomously plan, decide, and act on a user’s behalf.

I’m going to exchange words a lot, agents, systems, workflows. Does that matter? In professional environments, yes. Words matter. Shared terminology reduces ambiguity and increases productivity. For a personal article? Who gives a shit.

Unlike traditional generative AI, which focuses on producing content from prompts, agentic AI executes goal-directed, multi-step workflows by coordinating models, tools, memory, and external systems with minimal human oversight.

Depending on the system or workflow, agentic AI may require some form of input, but it doesn’t always have to be a prompt.

Think of an n8n workflow with multiple AI agents. A user might initiate it with a prompt, or it might automatically trigger itself via a webhook, message queue, or event.

Hope that makes sense. If not, no worries, as usual, I’m going to dig this rabbit hole pretty deep. This time I’m using ChatGPT to dig the hole, so it’ll probably go even deeper… and into a few wrong tunnels along the way.

1. What Is Agentic AI?

According to ChatGPT, Gemini, Claude, and basically every LLM I tried, Agentic AI refers to AI systems capable of:

Key distinction:

Generative AI responds.
Agentic AI acts.

Agentic AI Workflow

graph TD
    A[User Goal] --> B[Intent Interpretation]
    B --> C[Goal Decomposition]
    C --> D[Task Planning]
    D --> E{Policy Check}
    E -->|Approved| F[Tool Selection]
    E -->|Blocked| G[Human Review]
    G -->|Approved| F
    G -->|Rejected| H[Return Error]
    F --> I[Action Execution]
    I --> J[Monitor Results]
    J --> K{Goal Achieved?}
    K -->|No| L[Adapt Plan]
    L --> D
    K -->|Yes| M[Return Success]
    J --> N{Error Detected?}
    N -->|Yes| O[Error Handling]
    O --> L

2. What Agentic AI Looks Like in Practice

When I asked an LLM to generate real world examples, this is what I got, and honestly, I think they demonstrate agentic AI pretty well.

It’s not about one agent doing everything (like me using ChatGPT for literally everything).

It’s about achieving a specific goal using multiple specialized agents.

This is also a great way to mitigate LLM uncertainty.

Common real-world examples include:

Multi-Agent Collaboration Example

sequenceDiagram
    participant User
    participant Orchestrator
    participant IntentAgent as Intent Agent
    participant PlanAgent as Planning Agent
    participant DataAgent as Data Agent
    participant ActionAgent as Action Agent
    participant Systems as External Systems

    User->>Orchestrator: "Process refund for order #12345"
    Orchestrator->>IntentAgent: Parse user request
    IntentAgent->>Orchestrator: Goal: Refund order

    Orchestrator->>DataAgent: Fetch order details
    DataAgent->>Systems: Query CRM/ERP
    Systems-->>DataAgent: Order data
    DataAgent->>Orchestrator: Order: $150, Card ending 4321

    Orchestrator->>PlanAgent: Create refund plan
    PlanAgent->>Orchestrator: Steps: Validate, Process, Notify

    Orchestrator->>ActionAgent: Execute refund
    ActionAgent->>Systems: Call payment API
    Systems-->>ActionAgent: Refund successful

    ActionAgent->>Systems: Update order status
    ActionAgent->>Systems: Send customer email
    ActionAgent->>Orchestrator: All actions complete

    Orchestrator->>User: Refund processed successfully

3. Functional Architecture (Logical View)

Goal & Intent Interface

Cognition & Planning Layer

Reasoning & Model Layer

Execution & Integration Layer

Governance, Security, and Observability

Functional Architecture Diagram

graph TB
    subgraph "Goal & Intent Interface"
        A1[Natural Language Input]
        A2[API/Event Triggers]
        A3[Intent Parser]
    end

    subgraph "Cognition & Planning Layer"
        B1[Task Planner]
        B2[Policy Engine]
        B3[Memory Store]
        B4[Context Manager]
    end

    subgraph "Reasoning & Model Layer"
        C1[Foundation Models]
        C2[Tool Selection Logic]
        C3[Function Calling]
        C4[Decision Engine]
    end

    subgraph "Execution & Integration Layer"
        D1[Workflow Engine]
        D2[System Connectors]
        D3[Monitoring & Feedback]
        D4[Retry Logic]
    end

    subgraph "Governance & Security"
        E1[AuthN/AuthZ]
        E2[Policy Controls]
        E3[Audit Logging]
        E4[Guardrails]
    end

    A1 & A2 --> A3
    A3 --> B1
    B1 <--> B2
    B1 <--> B3
    B1 --> B4
    B4 --> C1
    C1 --> C2
    C2 --> C3
    C3 --> C4
    C4 --> D1
    D1 --> D2
    D2 --> D3
    D3 --> D4
    D4 -.Feedback.-> B3

    E1 & E2 & E4 -.Enforce.-> D1
    E3 -.Log.-> D2
    E4 -.Filter.-> C1

4. Physical / Deployment Architecture

Interaction Channels

Agentic AI Platform

Enterprise & External Systems

Security & Governance Infrastructure

Physical / Deployment Architecture Diagram

graph TB
    subgraph "Interaction Channels"
        U1[Web UI]
        U2[Mobile Apps]
        U3[Chat/Voice]
        U4[Email/API]
    end

    subgraph "Agentic AI Platform"
        direction TB
        P1[Orchestration Service]
        P2[LLM APIs]
        P3[Vector DB]
        P4[Knowledge Store]
        P5[Memory Service]
        P6[Agent Registry]
    end

    subgraph "Enterprise Systems"
        E1[(CRM)]
        E2[(ERP)]
        E3[(ITSM)]
        E4[(Databases)]
        E5[Internal Apps]
    end

    subgraph "External Services"
        X1[Payment APIs]
        X2[Messaging]
        X3[SaaS Platforms]
        X4[Cloud Services]
    end

    subgraph "Security & Governance"
        S1[IAM/SSO]
        S2[Policy Engine]
        S3[Audit/SIEM]
        S4[Approval Service]
        S5[Guardrails]
    end

    U1 & U2 & U3 & U4 --> P1
    P1 <--> P2
    P1 <--> P3
    P1 <--> P4
    P1 <--> P5
    P1 <--> P6

    P1 --> E1 & E2 & E3 & E4 & E5
    P1 --> X1 & X2 & X3 & X4

    S1 -.Auth.-> P1
    S2 -.Control.-> P1
    S3 -.Monitor.-> P1
    S4 -.Approve.-> P1
    S5 -.Filter.-> P2

5. Threat Modeling Considerations for Agentic AI

Why it’s different:
Agentic AI can autonomously chain actions across systems, increasing its potential blast radius. Because of that, I think it’s critical to map out tools, agents, permissions, and available resources before engagement.

Unique Risk Factors

Primary Threat Categories

Threat Model Visualization

mindmap
  root((Agentic AI
Threats))
    Input Attacks
      Prompt Injection
        Direct Injection
        Indirect Injection
      Data Poisoning
        Training Data
        Knowledge Base
      Jailbreaking
    Identity & Access
      Token Theft
        API Keys
        OAuth Tokens
      Privilege Escalation
        Horizontal
        Vertical
      Impersonation
    Action Manipulation
      Replay Attacks
      Output Tampering
      Tool Abuse
        Unauthorized Actions
        Chained Exploits
    Data & Compliance
      Over-Aggregation
        Cross-System Data
        PII Exposure
      Data Leakage
        Model Outputs
        Logs & Telemetry
      Regulatory Violations

Threat Mitigation Strategy Map

graph LR
    subgraph "Threat Categories"
        T1[Input Attacks]
        T2[Identity & Access]
        T3[Action Manipulation]
        T4[Data & Compliance]
    end

    subgraph "Control Layers"
        C1[Input Validation
& Filtering]
        C2[Authentication
& Authorization]
        C3[Execution
Controls]
        C4[Data Governance
& Monitoring]
    end

    subgraph "Specific Controls"
        S1[Prompt Sanitization]
        S2[Content Filtering]
        S3[Guardrails]
        S4[Fine-grained RBAC]
        S5[Token Management]
        S6[MFA/SSO]
        S7[Tool Allow-lists]
        S8[Action Approval]
        S9[Rate Limiting]
        S10[Data Classification]
        S11[Audit Logging]
        S12[Anomaly Detection]
    end

    T1 --> C1
    C1 --> S1 & S2 & S3

    T2 --> C2
    C2 --> S4 & S5 & S6

    T3 --> C3
    C3 --> S7 & S8 & S9

    T4 --> C4
    C4 --> S10 & S11 & S12