What Separates a Real AI Agent From a Chat Bot or Pipeline With a Name

An agent is a model that runs a loop: given a goal and resources, it decides which tool to call, observes the result, decides what to do next, and takes real actions toward the goal.

That sentence has five clauses, and each one excludes something currently being sold as an agent.

What each clause rules out

It decides which tool to call. The selection belongs to the system, not its author. If the order of operations is written down in advance, the thing is a pipeline. A pipeline can be excellent, and most professional work is a known sequence. It's still not an agent, because it can't handle the case its author didn't foresee.

It observes the result. What comes back from a call re-enters the reasoning instead of passing straight to the next stage. A system that fires a tool and hands the output onward has used a tool without observing anything.

It decides what to do next. A pipeline runs to its end. A loop can discover partway through that it asked the wrong question and go back, which is the only way a system handles a situation nobody anticipated. It's also the clause most often missing.

It takes real actions toward a goal. Action means reaching past producing text to changing state. Our system prompt for Dodona, our company-scoped oracle, calls this having hands and not only eyes. An agent that can only describe what it read has no way to be consequential, and so no way to be accountable. The goal is what makes the loop purposive rather than merely iterative, and it's what a person is answerable for having set.

It's given resources to do the job. These are the tools it may call, the data it may reach, the permissions it may exercise, a model to think with, and a budget of turns to spend. An agent is provisioned the way a new hire is, and someone made that decision and can be held to it.

This clause excludes the costume agents: the persona handed a goal and nothing to spend on it. It's also where accountability enters the definition from the supply side. Every credential an agent holds was granted, and every turn it takes was budgeted. When it acts, the question of who equipped it to act has an answer. A system with a goal and no resources is a wish. A system with resources and no goal is a hazard. An agent is the pair, and someone authored both halves. All five are required. They're also, increasingly, a commodity. Every serious framework released in the last two years hands a developer all five on the first afternoon, and that abundance is why the word got stretched.

Our own white paper puts the ratio plainly: the agents are the easy 30 percent, and the structure underneath them is the 70 percent that makes them worth running. That was written about our delivery pipeline, and it holds just as well for the analysis fleet. The work is what the loop is pointed at, what it's permitted to decide, what it was given to spend, what happens when it's wrong, and how anyone would find out. None of that got cheaper.

The loop is the easy part. What it's permitted to decide, and how anyone would find out when it was wrong, is the work.

Every false agent is an overcorrection toward something real

Each of the common impostors is a reasonable response to a real problem, which is why capable teams walk into them.

The scripted workflow gets something right: most professional work is a known sequence, and a fixed order is auditable, cheap, and repeatable in a way a loop isn't. But nothing in it chooses. It fails on the first input its author didn't anticipate, and it fails silently, because there's no decision point at which it could have noticed.

The named chatbot gets something right too. A name and a face make a tool legible and approachable, and grounding answers in a retrieved corpus is real engineering that meaningfully reduces invention. But it has eyes and no hands, and no resources beyond the corpus it was pointed at. The persona is applied to the surface rather than expressed as a commitment, so the system can never be caught out of character. A thing that can't be caught can't be trusted.

The unbounded autonomous agent has the correct architecture, since open-ended tool selection is where the actual capability lives. It's also the failure a sophisticated team is most likely to mistake for ambition. It has no turn budget, no gate, no stance, and no owner. Its resources are unmetered, so nothing about its behavior is priced. Removing the limits leaves the agency intact and takes the accountability out. Hand one 40 tools and a broad goal, and it will do remarkable things in a demo and produce conviction without an owner in production. When it's wrong, and it will be, nobody can say why and nobody can answer for it.

A stance is not a costume

Almost everything shipped as an agent persona is decoration: a name, a tone instruction, sometimes an illustrated face. The prose comes out warmer and the reasoning underneath is untouched. We hold that a persona is real only when it consists of commitments that constrain the output, because a commitment is the only kind of personality that can be violated.

Our fleet is built that way.

The Thesis Checker is instructed to be neither cheerleader nor cynic. The instruction has teeth because the agent scores execution and market view as two independent axes and composes them 60/40. A company can execute well inside a breaking thesis, or miss badly inside an intact one. Collapsing the axes would hide whichever one is failing, so the split is what makes the verdict legible.

Comparable Events is modeled on a court reporter, chosen for exactly one property: restraint. It records what was stated, attributes everything, and adds nothing. Its instruction is that eight events with honest nulls beat 12 with invented numbers. A code-level gate drops any estimated multiple, so the valuation math downstream can never anchor on a guess.

The Memo Analyst is deliberately adversarial, the counterweight to the even-handed Thesis Checker. It runs on the heaviest model we deploy. Its job is to attack the load-bearing assumptions in an investment memo. It's told to credit real strengths with conviction, because an adversary that dislikes everything carries no information.

The Follow-On Advisor is forbidden from doing arithmetic. Four valuation methods are computed deterministically in code, with stage discounts fixed in advance. The model chooses how to weight them and writes the narrative, and it's explicitly barred from recalculating a figure or applying ownership. Its judgment is real, and it's bounded to the one place where judgment belongs.

Round Radar may disagree with the base rate by 15 points and no further. A deterministic layer computes raise probabilities from runway and round cadence. The model may adjust each one by at most 0.15 in either direction, and only with a named reason. Its probabilities must be non-decreasing across widening windows, and code rejects a verdict that violates that.

Each of those is a description of what each system isn't allowed to do, which runs opposite to what agent marketing implies. The stance is the constraint. An agent with a personality and no constraints is wearing a costume. The test of the difference is whether the thing can be caught out of character in a way that costs something.

Counting our own fleet against our own test

Three of the five systems just described aren't agents by the definition above. Apply the five clauses to the fleet and it sorts into three tiers.

The loop runners. The two oracles, Dodona and Pythia, qualify without argument (we take Dodona apart clause by clause below). Among the analysts, the clearest case is the Thesis Checker. It runs as a 15-turn research agent with live search and scraping. It decides what to look up, reads what comes back, and decides what to look up next until it has earned its verdict. The other live-research analysts, Comparable Events and Competitor Discovery among them, carry the same license to go find what they need rather than reason only over what they were handed. These satisfy all five clauses. They choose, observe, and iterate, they spend real resources they were granted, and what they conclude persists as state the rest of the firm builds on.

The judgment specialists. These are the Follow-On Advisor, Round Radar, the Financial Model Analyst, the Benchmark Analyst, and the Memo Analyst. For each, the orchestrator assembles the inputs, a deterministic layer computes whatever is computable, and the model renders one bounded judgment that code then gates and persists. There's no tool selection inside the run and no loop. They have no resources of their own, because the orchestrator spends on their behalf. By the definition, they fail clauses one through three and five, and we designed it that way. The Follow-On Advisor is denied arithmetic. Round Radar is denied more than 15 points of disagreement. Denying a component an open loop is the same kind of constraint, applied one level up. We decided that for these judgments, a single decision point with everything on the table beats an open-ended search, because a bounded read is auditable in a way a wandering one isn't. These are specialists. They hold stances and make claims, they aren't agents, and we use the two words to mean two things.

The plumbing. The utility and classifier tier doesn't qualify either. This tier includes a note-intent classifier running at temperature zero, an attachment classifier routing an inbound email, and a backfill that determines when an event in an article actually occurred. Each reasons over content with a model, and each is mechanical by design. There's no tool selection, no loop, no goal beyond the one call it was invoked to make, and no resources beyond that call. The single-pass document parsers are the same: they read a file and return structured JSON. They're among the most carefully engineered components we run, and they sit outside the definition entirely.

Agents are a minority of what we run. Most of the fleet is specialists and plumbing arranged around a small number of true loops, and that ratio is a design position rather than an admission. The marketing pressure runs toward calling all of it agents, and a word stretched to cover everything means nothing.

Is Dodona a real agent?

Dodona satisfies all five clauses. It runs on Claude Sonnet 4.6 at temperature 0.4, with 16 tools it selects among on its own:

• Eight are read tools.
• Four write to the client's database, so it can change company fields, log metrics, and create timeline events and notes.
• Four reach past its own output: it can trigger another agent's analysis, re-extract a document that parsed wrong, attach files to a pending update, and file a ticket against the platform itself.

That toolkit, the database permissions behind it, and the model it thinks with are the resources of clause five, and every one of them was granted deliberately.

It also runs in a second, more literal form. askCompanyOracle is Dodona invoked as a sub-agent by Pythia, our fund-level oracle, from inside Pythia's own loop. In that form it gets a company-scoped registry of eight tools and a six-turn budget. It escalates exactly once, to 12 turns, if it exhausts the budget or finishes and reports low confidence with a named missing input, and the reason is logged. It closes by reporting its own confidence and the single most important thing it didn't have. An agent dispatching another agent, provisioning it with a scoped toolkit and a metered budget, and reading back structured judgment about the limits of that judgment is about as unambiguous as the term gets.

The turn budget matters as much as the tool count, because it sets the point where the agent has to stop. Six turns with one audited escalation is a different design from unlimited turns. Bounded, logged, and rare by design is what separates an agent from a process nobody is supervising.

The ticket nobody asked for

Our strongest evidence is something Dodona did that nobody scripted.

In the middle of a conversation about a single company, Dodona noticed that the platform was summing tranches denominated in pounds as though they were dollars. It could have corrected the figure in front of it and moved on, which is what a retrieval system would have done. Instead it formed a judgment: the error wasn't really about this company, it would recur wherever the same code path ran, and the correct response was to file it against the platform with a proposed fix. Then it did the same thing nine more times across the session, including catching a fair-market-value figure misstated by roughly $10 million.

All 10 were real defects, and no human asked Dodona to look for any of them. The disposition behind them lives in the agent's character section rather than its tool list. The prompt tells Dodona to take pride in improving the platform, prefer a few sharp tickets over a flood, never file one for correcting a single company's figure, and always do it transparently. We wrote that disposition, but each call about what to file was Dodona's own.

A platform that reports its own arithmetic errors is easier to trust than one that has never reported any. We'd rather our agent catch a mistake like that than wait for a client to.

That's what the fourth clause of the definition looks like when it's real. A system formed a view about the machine it's part of, set itself a goal nobody handed it, and acted on that view without being asked.

Something that can be wrong on the record

We left one more property out of the definition on purpose: a track record. A system can satisfy all five clauses and not have it. And, as our own fleet demonstrates, a system can fail the definition and have it in full. It tells you whether to trust a system with judgment.

Six of our systems emit falsifiable claims at the moment they persist an opinion:

• The Thesis Checker's conviction score
• The Follow-On Advisor's recommendation and fair-value range
• The Financial Model's forward call
• Round Radar's raise windows
• The Memo Analyst's quality score
• Predictive Signals' dated predictions

Only one of those, the Thesis Checker, is a loop-running agent. Four of the others are specialists that fail the definition. Our prediction ledger scores them all the same way, because it scores the claim, and a specialist that commits to a number can be caught being wrong just as an agent can.

Each claim carries a resolution specification and a close window, and the exact input bundle that produced it is frozen alongside it. A resolution engine later asks reality whether the claim came true and closes it with a score between zero and one. Ambiguous outcomes route to a queue a person settles.

Then the record feeds back. Once one of these systems has accumulated at least 20 resolved claims inside a firm, a summary of its own accuracy is injected back into its prompt. Three disciplines govern that injection:

• A floor, so a small sample never misleads.
• Firm scoping, so it sees only its own record within that client.
• An anti-gaming instruction telling it the block exists to calibrate its confidence, and that it must not hedge, widen ranges, or soften a call to protect its score.

A workflow can't have a track record, because it produces output and never makes a claim. None of that output can turn out to be false, so there's nothing to score, and running it longer never builds evidence that it deserves to be believed. The same holds for a chatbot over a document index. It can be inaccurate, but it can't be wrong in the specific sense of having committed to something that reality later refuted.

That's why we run both. The definition tells you what a system is. The ledger tells you whether to believe it. A buyer evaluating a fleet should want the second answer more than the first, and should be suspicious of any vendor whose materials supply only the first.

Questions to ask anything sold as an agent

If you're evaluating something sold as an agent, ask the vendor:

• Does it choose its own tools, and can you see the trace of what it chose and why?
• Can it change anything, or only describe?
• What goal was it given, and who set it?
• What resources was it granted, who signed off on the grant, and what does each action cost?
• What's its turn budget, and what happens when it reaches the ceiling?
• What is it forbidden from doing, and does the prohibition live in code or in a paragraph of the prompt?

A vendor who can answer those has built the hard part. One who reaches for autonomy as the answer has usually built the easy part and named it ambitiously. And one who tells you every component in their fleet is an agent has answered a question you didn't ask while dodging the ones you did.

Two questions matter more than all the others. What did it claim 90 days ago, and was the claim right? And, because a system can be right by saying the same safe thing about every case, did it say different things about different cases, and how much of the available surface did it address at all?

---

Vantage is the operating system for the modern venture firm: We put AI where it holds the asymmetric advantage and keep humans where they are irreplaceable. Book a demo with our team to see what it looks like.

Conviction Made Citable.