Agentic AI: who picks the next step

January 6, 2025, Las Vegas. Jensen Huang is on the CES stage saying enterprise agents are a “multi-trillion-dollar opportunity,” from medicine to software development. From that week on, nearly every deck I saw picked up the word agentic, usually on slide two. MIT Sloan and BCG surveyed organizations in spring 2025: 35% said they had already adopted agents, and another 44% said they would soon. No question in the survey checked what exactly they had adopted.

That’s the problem with the word. Agentic AI isn’t a new model and it isn’t a product. It’s really one question: who decides the next step in your software, the code or the model. Once you put it that way, you can measure it on Monday.

The word is old, the adjective is new

Interface.ai traces the root to psychologist Albert Bandura and his idea of human agency. Nice, but in AI the word agent is much older than the trend. Russell and Norvig’s 1995 textbook is built entirely around the agent: something that perceives an environment and acts on it.

What’s new is the adjective. Andrew Ng pushed “agentic workflows” in March 2024, in a talk at Sequoia and in his newsletter The Batch, and by September 2024 it was in The New York Times. From there it just stuck. By June 2025 Gartner was already warning about agent washing, estimating that only about 130 of the thousands of vendors selling “agentic” actually build agents.

A classic hype sign: Agentic Engineer showed up in job titles long before anyone agreed on what it meant.

Agentic is a dial, not a switch

Ng put it best: instead of arguing whether a system is an agent or not, think in degrees. A system can be a little agentic or very agentic. Anthropic drew the practical line in their December 2024 post Building effective agents. A workflow is when the LLM and tools run along a path you wrote in code ahead of time. An agent is when the model itself decides the process and the tools, step by step.

What it isn’t:

• Not a chatbot with a longer prompt. A chatbot answers and waits for you.
• Not necessarily multi-agent. C3 defines agentic as orchestration of specialized agents, but that’s one architecture, not the definition.
• Not RPA with an LLM in the middle. If the path is fixed, it’s a workflow, and that’s perfectly fine.

The loop, step by step

In practice, every agent I’ve seen is the same loop:

1. You give a goal, not instructions.
2. The model plans and picks a tool with arguments.
3. The harness runs the tool. Not the model.
4. The result goes back into context.
5. Check: are we there? Over budget? Does the output pass the verifier?
6. Back to step 2, or stop.

Tamar Yehoshua, former president of product and technology at Glean, described it at the Real-time Data Summit in 2024:

“We’re seeing the beginning of agents that do work for you… that won’t just do one task, but will do multiple tasks… We’ll call those multi-step processes or loops.” — Tamar Yehoshua, Glean

So what does that do to cost? Every turn resends the whole context. Step 20 pays for the 19 steps before it. Without prompt caching, the bill grows much faster than the step count.

Worked numbers: GPT-3.5 beats GPT-4

This is the number that made Ng the word’s prophet. In The Batch, March 2024, he showed HumanEval results, a coding benchmark. GPT-3.5 zero-shot solved 48.1%. GPT-4 zero-shot solved 67.0%. And GPT-3.5 wrapped in an agentic loop reached up to 95.1%.

What did the loop do? Wrote code, ran tests, read the error, fixed it, went again. Look at that for a second: the gain didn’t come from the model “deciding on its own.” It came from having something to check against. Without tests, the same loop would spin and convince itself it was right.

Short version: the value of agentic comes from verification inside the loop, not from autonomy.

When not to hand the model the wheel

July 2025. Jason Lemkin, founder of SaaStr, is building an app with Replit’s agent. In the middle of an explicit code freeze, the agent deletes the production database, then tells him there’s no way to restore it. As it turned out, the rollback worked. Amjad Masad, Replit’s CEO, apologized publicly and announced automatic separation between dev and prod.

What was missing? Not a smarter model. A boundary. The agent had write access to prod, and nothing outside the model stopped it.

Gartner, same summer: over 40% of agentic AI projects will be canceled by the end of 2027, due to costs, unclear business value and weak risk controls. Not surprising. My rule is simple: if you can draw the flowchart, write it as code. An agent is worth the price only when there are too many paths to draw.

My take: Most of what enterprises call agentic today is a workflow with an LLM in one step, and that’s actually the good part. I don’t buy the idea that autonomy is a goal. Autonomy is a cost, and you pay it only when you have no choice.

What to try this week

Take one flow in your shop that someone called agentic and walk through it:

1. Count how many “what’s the next step” decisions the model makes on its own. If it’s zero, it’s a workflow. Call it that; it’ll save an argument at the next meeting.
2. Every step you can write as an if, write as an if. Cheaper, faster, and it doesn’t wander off.
3. Put the ceiling in the harness, not the prompt: MAX_STEPS and a token budget. A model doesn’t enforce limits on itself.
4. A verifier for every loop: tests, a JSON schema, a second model or a human.
5. Every tool that writes (DB, email, deploy) goes through approval or a dry-run. And prod credentials never enter the agent’s sandbox at all.
6. A trace for every step: which tool, what arguments, what came back. Without it you have no way to understand why one run cost 10x the other.

The skeleton I start from:

MAX_STEPS = 12
MAX_TOKENS = 200_000
WRITE_TOOLS = {"db_write", "send_email", "deploy"}


def run(goal, llm, tools, verify, approve):
    messages = [{"role": "user", "content": goal}]
    used = 0
    for step in range(MAX_STEPS):
        reply = llm(messages)
        messages.append(reply.as_message())
        used += reply.usage.total_tokens
        if used > MAX_TOKENS:
            return {"status": "budget", "step": step}
        if reply.tool is None:
            ok, why = verify(reply.text)
            if ok:
                return {"status": "done", "answer": reply.text, "step": step}
            messages.append({"role": "user", "content": f"Check failed: {why}. Fix it."})
            continue
        if reply.tool.name in WRITE_TOOLS and not approve(reply.tool):
            messages.append({"role": "user", "content": "Write rejected. Find another way."})
            continue
        result = tools[reply.tool.name](**reply.tool.args)
        messages.append({"role": "tool", "content": str(result)[:4000]})
    return {"status": "max_steps"}

There are two exits here that aren’t done, and that’s on purpose. Plenty of real runs end exactly there, and you want to know where.

If you can’t answer “when does this loop stop,” you don’t have an agent. You have an open invoice.