Autonomous and semi-autonomous AI agents are systems delegated to pursue goals through a sequence of observations, decisions and actions. Unlike a conversational assistant that primarily responds turn by turn, an agent may decompose a task, select tools, execute operations, inspect results, update a plan, recover from failure and continue until a stopping condition is reached. Autonomy is not binary.
Autonomous and semi-autonomous AI agents are systems delegated to pursue goals through a sequence of observations, decisions and actions. Unlike a conversational assistant that primarily responds turn by turn, an agent may decompose a task, select tools, execute operations, inspect results, update a plan, recover from failure and continue until a stopping condition is reached. Autonomy is not binary.
An autonomous or semi-autonomous AI agent is defined here as a machine system that receives a goal, observes an environment, selects and executes actions through available tools, maintains task-relevant state and uses resulting observations to continue or revise its behaviour.
The primary constraint reduced is the need for a human to coordinate every step of an information workflow. An agent can preserve task state, move between applications, monitor conditions and adapt a sequence when intermediate results change.
Unlike a conversational assistant that primarily responds turn by turn, an agent may decompose a task, select tools, execute operations, inspect results, update a plan, recover from failure and continue until a stopping condition is reached. Systems vary in the scope of goals they accept, the actions they can perform, the time over which they operate and the degree of human approval required. The concept inherits from classical artificial intelligence, robotics, planning, software agents and reinforcement learning.
It built on Database management systems, Recommendation Algorithms and Personalised Feeds, Generative Language Models, Conversational AI Assistants and Retrieval-Augmented Generation and Cloud computing and cloud storage.
Its methods, infrastructure or conventions were absorbed into later information systems.
Older methods continued where they remained cheaper, more trustworthy, more accessible or better suited to local needs.
The system can change files, send messages, operate applications, purchase services or control machines rather than merely describe what should happen. An agent can preserve state across several operations and adapt when intermediate results differ from expectation. Users can specify goals without manually programming every branch of a workflow.
Autonomous and semi-autonomous AI agents are systems delegated to pursue goals through a sequence of observations, decisions and actions. Unlike a conversational assistant that primarily responds turn by turn, an agent may decompose a task, select tools, execute operations, inspect results, update a plan, recover from failure and continue until a stopping condition is reached. Autonomy is not binary. Systems vary in the scope of goals they accept, the actions they can perform, the time over which they operate and the degree of human approval required.
The concept inherits from classical artificial intelligence, robotics, planning, software agents and reinforcement learning. Language models add a flexible interface for interpreting instructions, representing intermediate plans and choosing tools described in natural language. ReAct demonstrated the interleaving of language-model reasoning traces with actions and observations. Toolformer explored models learning when and how to call external APIs. Later systems connected models to browsers, code interpreters, operating systems, games and scientific workflows. [S01-S08]
The decisive boundary is authority. A model output becomes an agentic system when it can affect external state through delegated credentials, tools or messages. Producing a draft email is generation. Sending it is action. Suggesting a database change is assistance. Executing the change is delegated operation. The same model can therefore inhabit very different risk categories depending on its tool access and approval architecture.
Agents reduce the coordination cost of multi-step information work. They can monitor changing conditions, repeat routine operations and carry state between steps. Yet errors compound. A mistaken observation can create a bad plan; a bad plan can trigger an irreversible action; the changed environment then becomes new evidence that appears to validate the agent’s path. Recovery, permission design, logging and human interruption are therefore core architecture rather than optional safety garnish.
This topic matters because information systems cease merely to advise and begin to act. The transmission chain closes into a control loop. Meaning generated by the machine can alter the world from which its next observations are drawn.
AI agents turn machine-generated interpretation into delegated action across time. Their defining achievement is sustained goal pursuit through tools, memory and feedback. Their recurring danger is that probabilistic interpretation can acquire real authority, allowing small errors, ambiguous instructions or compromised observations to propagate through consequential operations before a human notices.
Reduces the human coordination required to pursue multi-step goals across changing digital environments
Start with the key connections, then reveal the wider network when you need more context.
Stores task state, records and operational data.
Contributes ranking and action selection methods.
Provides flexible planning and tool-selection representations.
Provides natural-language interaction, evidence retrieval and tool mediation.
Hosts models, schedulers, sandboxes and persistent execution.
Extends device-mediated action beyond direct user control.
Can authenticate tools, actions, records and generated artefacts.
Both convert scores into decisions, but agents pursue broader goals across steps.
AI planning, robotics and distributed software established goal-directed action and observation loops.
APIs and scripted automation made digital actions composable, though generally through explicit workflows.
This marks the broad emergence and development of Autonomous and Semi-Autonomous AI Agents. Why it mattered: Reduces the human coordination required to pursue multi-step goals across changing digital environments.
Interleaved reasoning traces, actions and observations for language-model task solving.
ReAct, Toolformer and related systems connected general language interpretation to external actions.
Memory, reflection, computer use, coding and multi-agent systems expanded the horizon and exposed compounding failures.
Explored self-supervised learning of API use within a language model.
Combined memory, reflection and planning in a simulated social environment.
Demonstrated continual exploration and a reusable skill library in Minecraft.
NIST is one of the organisations connected to this topic. Open the profile for the wider historical context.
These expandable sections preserve the detailed research behind the public explanation.
Autonomous and semi-autonomous AI agents are systems delegated to pursue goals through a sequence of observations, decisions and actions. Unlike a conversational assistant that primarily responds turn by turn, an agent may decompose a task, select tools, execute operations, inspect results, update a plan, recover from failure and continue until a stopping condition is reached. Autonomy is not binary. Systems vary in the scope of goals they accept, the actions they can perform, the time over which they operate and the degree of human approval required.
The concept inherits from classical artificial intelligence, robotics, planning, software agents and reinforcement learning. Language models add a flexible interface for interpreting instructions, representing intermediate plans and choosing tools described in natural language. ReAct demonstrated the interleaving of language-model reasoning traces with actions and observations. Toolformer explored models learning when and how to call external APIs. Later systems connected models to browsers, code interpreters, operating systems, games and scientific workflows. [S01-S08]
The decisive boundary is authority. A model output becomes an agentic system when it can affect external state through delegated credentials, tools or messages. Producing a draft email is generation. Sending it is action. Suggesting a database change is assistance. Executing the change is delegated operation. The same model can therefore inhabit very different risk categories depending on its tool access and approval architecture.
Agents reduce the coordination cost of multi-step information work. They can monitor changing conditions, repeat routine operations and carry state between steps. Yet errors compound. A mistaken observation can create a bad plan; a bad plan can trigger an irreversible action; the changed environment then becomes new evidence that appears to validate the agent’s path. Recovery, permission design, logging and human interruption are therefore core architecture rather than optional safety garnish.
This topic matters because information systems cease merely to advise and begin to act. The transmission chain closes into a control loop. Meaning generated by the machine can alter the world from which its next observations are drawn.
AI agents turn machine-generated interpretation into delegated action across time. Their defining achievement is sustained goal pursuit through tools, memory and feedback. Their recurring danger is that probabilistic interpretation can acquire real authority, allowing small errors, ambiguous instructions or compromised observations to propagate through consequential operations before a human notices.
| Field | Value | |---|---| | Public title | Autonomous and Semi-Autonomous AI Agents | | Analytical title | Delegated Machine Systems That Observe, Plan, Act, Monitor and Revise Across Multi-Step Environments | | Recommended type | Goal-directed machine action system | | Primary category | Interpretation & mediation | | Secondary categories | Processing; interaction; governance; feedback; identity; security; coordination | | Emergence | Classical software agents and planning research in the late twentieth century; language-model-based tool-using agents in the 2020s |
An autonomous or semi-autonomous AI agent is defined here as a machine system that receives a goal, observes an environment, selects and executes actions through available tools, maintains task-relevant state and uses resulting observations to continue or revise its behaviour.
The topic includes language-model agents, planning-and-execution loops, browser and computer-use agents, code agents, robotic or simulated embodied agents where relevant to information work, multi-agent coordination, tool registries, agent memory, scheduling, monitoring, reflection, verification, approval gates and rollback mechanisms.
It excludes a single generated answer with no external action; deterministic automation following a fully specified workflow without adaptive interpretation; ordinary recommendation systems; and the underlying language model considered independently. A system may be semi-autonomous when humans approve plans or high-risk actions while the machine handles lower-risk steps. Autonomy is evaluated by actual authority and persistence, not marketing language.
The operational definition deliberately describes a socio-technical system rather than a single model checkpoint. The topic includes the surrounding interfaces, retrieval or action channels, policy controls, identity boundaries, logs, feedback loops and institutional responsibilities required for the system to function in practice. A demonstration that produces one impressive output does not establish that the surrounding system is reliable, governable or suitable for consequential use.
The system can change files, send messages, operate applications, purchase services or control machines rather than merely describe what should happen.
An agent can preserve state across several operations and adapt when intermediate results differ from expectation.
Users can specify goals without manually programming every branch of a workflow.
Agents can watch conditions and act when thresholds or events occur.
Credentials, permissions and approval gates determine what generated decisions can affect.
Each observation and action changes the context for the next step, creating trajectories rather than isolated mistakes.
Model provider, tool owner, deployer, user and affected third parties may each control part of the system.
Agents can negotiate, delegate and exchange structured information with other services or agents.
An assistant centres on interaction and proposals. An agent is authorised to pursue a goal through actions across steps.
The model generates decisions or plans. The agent includes tools, state, permissions, execution and monitoring.
A fixed workflow follows predetermined branches. An agent interprets state and can choose among actions adaptively.
One externally invoked function is not sufficient. Agency involves continued goal-directed selection and feedback.
A simple thermostat can be autonomous within a narrow loop. Broad intelligence and autonomy are different dimensions.
A plan is a proposed sequence. Execution changes state and creates consequences.
Authorisation to perform an action does not establish ability to perform it safely.
Tool results, webpages and sensors can be wrong, stale, manipulated or incomplete.
Stored notes can contain mistaken inferences and should not automatically become authoritative records.
Clicking approve may not provide meaningful oversight when plans are opaque or review is rushed.
Agents can imitate roles without possessing legal authority, duty or social legitimacy.
Delegation preserves defined responsibility and oversight. Abdication leaves consequential behaviour without accountable control.
Delegated goal → identity and permission check → environment observation → state construction → task decomposition → action selection → approval decision → tool execution → external state change → result observation → verification → plan revision → completion, escalation or termination
A semi-autonomous path inserts approval gates before expensive, irreversible or externally visible actions. A monitoring agent may wait between observations. A multi-agent path adds delegation messages, shared memory and conflict resolution. Each added loop increases both capability and the surface for error.
The pattern matters because the final response or action can conceal the number of transformations that preceded it. Each transformation can introduce omission, ranking bias, stale state, permission failure, tool error, policy intervention or unsupported inference. Treating the visible output as a direct window onto the source erases the architecture that produced it.
The expanded agent architecture contains eight layers:
The safe operating envelope is the intersection of competence, permission, observability and reversibility. High competence without permission is intrusion. Permission without competence is a loaded forklift in a nursery. Observability without interruption is merely a beautifully documented accident.
A receiver should be able to distinguish at least four objects:
When these objects are collapsed, generated text can masquerade as retrieved evidence, a proposed action can masquerade as an authorised action, and a signed provenance claim can masquerade as proof that the depicted proposition is true.
The idea of agents predates contemporary language models. Classical AI studied planning, search, expert systems and rational action, while distributed computing developed software agents that communicated and operated on behalf of users. Robotics and reinforcement learning formalised observation-action loops in physical and simulated environments.
Language models changed the interface between goals and tools. ReAct showed that a model could interleave natural-language reasoning with actions and observations on question-answering and interactive tasks. Toolformer explored self-supervised learning of when and how to call APIs. These approaches made tool descriptions legible to a general language model and allowed one model to orchestrate heterogeneous services. [S01-S02]
Generative Agents combined language models with memory, reflection and planning in a simulated social environment. Voyager used a language model, an automatic curriculum and a reusable skill library to operate continually in Minecraft. These systems illustrated persistent trajectories and adaptive skill accumulation, though simulated success should not be confused with dependable operation in open organisations. [S03-S04]
Benchmarks such as AgentBench and GAIA evaluated systems across interactive environments and real-world assistant tasks. Their results exposed a gap between impressive isolated demonstrations and consistent multi-step performance. Small errors in planning, tool selection, interface use and state tracking accumulate across long horizons. [S05-S07]
Governance frameworks increasingly describe AI systems along a spectrum of human involvement rather than a binary autonomous/not-autonomous label. NIST's AI Risk Management Framework emphasises context, human oversight, documentation, monitoring and risk management across system life cycles. [S08-S09]
The prerequisites are cumulative rather than merely chronological. Later systems inherit older infrastructures and their weaknesses: network dependence, identity ambiguity, opaque ranking, database drift, uneven language coverage, brittle authentication and concentrated platform control. Machine mediation does not replace the transmission map beneath it. It piles another interpretive layer on top.
AI planning, robotics and distributed software established goal-directed action and observation loops.
APIs and scripted automation made digital actions composable, though generally through explicit workflows.
ReAct, Toolformer and related systems connected general language interpretation to external actions.
Memory, reflection, computer use, coding and multi-agent systems expanded the horizon and exposed compounding failures.
Agents are being bounded by permission systems, approval gates, audits, budgets and domain-specific operating rules.
The primary constraint reduced is the need for a human to coordinate every step of an information workflow. An agent can preserve task state, move between applications, monitor conditions and adapt a sequence when intermediate results change.
The reduction is strongest in repetitive, observable and reversible work. It weakens when goals are ambiguous, environments are adversarial, success is difficult to verify or actions affect rights, safety and money. In those settings, the coordination burden returns as supervision, review and incident response.
Reducing one constraint moves pressure elsewhere. The system may reduce the time needed to find, compose or execute information work while increasing the need for verification, permissions, monitoring, provenance, appeal, exception handling and human judgment. Labour is not always eliminated. It is often redistributed from production towards supervision and recovery.
| Dimension | Effect | Strength | Qualification | |---|---|---|---| | Multi-step coordination | Large reduction in manual orchestration | High | Only where tools and state are reliable. | | Speed | Parallel or continuous operation | High | Fast failure can scale damage. | | Persistence | Can continue beyond one interaction | High | Requires stopping, expiry and monitoring. | | Adaptability | Can revise plans after observations | Medium-high | Replanning can amplify mistaken state. | | Labour displacement | Automates routine information work | Variable | Creates review, integration and recovery labour. | | Accountability | Logs can improve auditability | Medium | Distributed responsibility may remain unclear. | | Security | Can enforce scoped credentials | Variable | Tool access creates a powerful attack surface. | | Reliability | Useful in bounded environments | Variable | Long-horizon errors compound rapidly. |
Agentic systems convert access into authority. The party controlling credentials, tool descriptions, approval rules and logs determines what the agent can do and whose interests it serves. Organisations may use agents to increase employee capacity, centralise management surveillance or replace discretion with opaque automated procedure.
The user’s apparent delegation may also be constrained by platform policy. A personal agent can act only through the APIs and operating-system permissions available to it. Service providers may revoke access, impose rate limits, prioritise their own products or observe the agent’s actions. The agent therefore inherits the political economy of every infrastructure it touches.
Affected third parties often have no relationship with the person who delegated the task. An agent can send messages, make offers, scrape sites or alter shared records at scale. Governance must therefore consider not only user consent, but the rights of people encountered downstream.
A mistaken early observation can distort planning, execution and later evidence across an entire trajectory.
Broad credentials allow a model error or prompt injection to affect files, money, communications or infrastructure.
Messages, transfers, deletions and public posts may not be fully recoverable.
The system can satisfy literal wording while violating the user’s unstated purpose.
Malicious webpages, documents or tool outputs can steer subsequent actions.
The agent can repeat failed steps, consume resources or generate cascading messages.
Incorrect memory or incomplete environment state can become the basis for future decisions.
Humans may approve plans mechanically because reviewing them is slower than doing the task themselves.
Provider, deployer, user and tool owner can each blame another layer.
An agent can combine individually harmless tools into an unintended high-impact capability.
Routine coordination work may be devalued before reliable alternatives and social protections exist.
Agents negotiating or competing with one another can create volumes and tempos humans cannot meaningfully supervise.
An agent may communicate as though it were a human or authorised representative.
Long-running tasks can continue after circumstances or user intentions change.
| Relationship | Topic | Explanation | |---|---|---| | Predecessor | Conversational AI Assistants and Retrieval-Augmented Generation Conversational AI Assistants and RAG | Provides natural-language interaction, evidence retrieval and tool mediation. | | Predecessor | Generative Language Models Generative Language Models | Provides flexible planning and tool-selection representations. | | Predecessor | Database management systems Database Management Systems | Stores task state, records and operational data. | | Predecessor | Cloud computing and cloud storage Cloud Computing and Storage | Hosts models, schedulers, sandboxes and persistent execution. | | Predecessor | Recommendation Algorithms and Personalised Feeds Recommendation Algorithms | Contributes ranking and action selection methods. | | Sibling | Automated Classification and Content Moderation Automated Classification and Moderation | Both convert scores into decisions, but agents pursue broader goals across steps. | | Governance | Digital Provenance and Authenticity Systems Digital Provenance | Can authenticate tools, actions, records and generated artefacts. | | Successor | Machine-to-machine workflows | Agents coordinate directly across services and organisations. | | Successor | Delegated robotic operations | The same architecture can extend from digital tools to physical actuators. | | Feedback | All operational topics | Agent actions alter the environment and become new inputs to the map. |
Interleaved reasoning traces, actions and observations for language-model task solving. [1]
Explored self-supervised learning of API use within a language model. [2]
Combined memory, reflection and planning in a simulated social environment. [3]
Demonstrated continual exploration and a reusable skill library in Minecraft. [4]
Evaluated language-model agents across several interactive environments. [5]
Proposed real-world questions requiring reasoning, multimodality, browsing and tool use. [6]
Evaluated autonomous research agents performing machine-learning experimentation. [7]
Provided a risk-management framework applicable across differing degrees of autonomy and human oversight. [S08-S09]
The agent completes the task but exceeds delegated permission or violates policy.
An operation is syntactically correct but applies to the wrong file, account or recipient.
The environment changes between planning and execution.
The final message reports completion although one or more steps failed.
A human approves a broad plan that conceals risky individual actions.
A sub-agent receives more authority than its narrow task requires.
The system repeatedly retries an operation that cannot succeed.
Tool calls, computation or purchases consume resources without adequate progress.
Agents use different assumptions or schemas and amplify one another’s errors.
A webpage or tool response is crafted to redirect the agent.
A nominal undo does not recover external messages, copied data or downstream effects.
The stop control is unavailable, delayed or ignored during execution.
| Claim | Type | Confidence | Evidence | |---|---|---|---| | ReAct interleaves language reasoning with actions and observations | Technical | High | [1] | | Toolformer explored models learning when and how to invoke APIs | Technical | High | [2] | | Memory, reflection and planning have been combined in simulated language-model agents | Technical | High | [3] | | Persistent agents can accumulate reusable skills in simulated environments | Technical | High | [4] | | Interactive benchmarks reveal substantial difficulty across multi-step tasks | Empirical | High | [S05-S07] | | Human oversight and risk management must be matched to context and system configuration | Governance | High | [S08-S09] | | Autonomy and intelligence are separate dimensions | Analytical | High | Boundary analysis | | Actual authority depends on tool access and credentials, not conversational appearance | Architectural | High | Research notes synthesis | | Long-horizon reliability is lower than isolated-step performance when errors compound | Analytical/empirical | High | [S05-S07] | | Human approval does not guarantee meaningful oversight | Governance | Medium-high | Research notes synthesis |
Assistants answer and propose. Agents continue through observations and execute actions towards a goal.
Scripts follow explicit instructions. Agents interpret changing state and select among possible actions.
RPA is generally workflow-bound. Language-model agents can handle unstructured inputs but are less predictable.
Recommendations select content or actions for a recipient. Agents act within an environment and observe consequences.
Human delegates possess social judgment and legal responsibility. Machine agents require these functions to be assigned externally.
The abstract loop is related, but physical safety, sensing and legal regimes differ substantially from information-work agents.
An organisation includes durable roles, legitimacy and accountability. A group of models exchanging messages does not automatically acquire those properties.
The meaningful unit of agent risk is not the generated sentence. It is the full trajectory of observations, permissions, actions and consequences.
Autonomous and semi-autonomous agents close the distance between machine interpretation and external consequence. A language model can describe a plan; an agent can carry it through files, browsers, APIs, messages and other systems. That transition is not a small feature upgrade. It is the transfer of bounded authority.
The most promising uses are mundane and valuable: monitoring, reconciliation, routine administration, software maintenance and assistance across inaccessible interfaces. These tasks have observable steps, repeatable checks and often reversible effects. Agentic systems can preserve state and relieve people from constant application switching.
The same loop makes failure cumulative. The agent acts on an interpretation, observes the changed environment and uses that observation to justify the next action. A bad trajectory can become self-reinforcing. Permission design, approval gates, verification and rollback must therefore be part of the system’s core, not a compliance sticker attached after deployment.
For the map, agents represent a historic turn from information systems that answer to information systems that pursue. The crucial question is no longer only whether the machine’s statement is correct. It is what the machine is allowed to do before anyone discovers that it was wrong.