From Programme to Agent

Part IAgency lives in the coupling

Software is usually classified by what its code contains: rules, learned parameters, search, memory or a planner. Agency cuts across those categories. A lookup table can control a situated system. A large neural model can remain a passive function. The classification depends on the programme’s role in a larger causal circuit.

Thought experiment one: the same programme in two sockets

Take a function that receives temperature and returns either HEAT_ON or HEAT_OFF. In the first socket, a researcher feeds it a spreadsheet of yesterday’s readings. The function writes a column of outputs. Nothing observes whether a room warms. In the second socket, a controller samples a live sensor every minute, executes the returned command against a heater, and samples again. The code is identical. The causal role is not.

The spreadsheet use is a calculation. The controller use is a thin agent because its choices participate in a persistent loop with the room. The room is not merely input data. It is an environment whose later state partly depends on the controller’s earlier action. This is why agency cannot be read from a source file alone.

The cutaway makes a further distinction. A policy can propose an action without possessing authority to execute it. A rover’s motor controller may have direct permission to move within a sandbox. A banking assistant should not acquire payment authority merely because it can formulate a valid instruction. Capability selects a possible effect; authority determines whether that effect may be attempted.

An operational definition

“Bounded” matters. The environment may be a room, a game, a browser, a repository or an enterprise workflow. The boundary tells us what the agent can observe and affect. “Criterion” may be a target state, reward, rule set, service objective or termination test. It need not be a human-like desire. “Across time” excludes a single isolated mapping unless that mapping is one step inside a continuing controller.

This definition is intentionally functional. It does not imply consciousness, moral agency, understanding or self-authored purposes. Those are separate questions. It also leaves room for degrees. A thermostat has a narrow action space, little state and a fixed criterion. A repair agent may inspect several systems, maintain a case state and replan. Both can instantiate the loop, while differing drastically in competence and consequence.

A boundary test, not a badge

The strongest objection is that “agent” is observer-relative. A process that looks autonomous at one scale may be a subroutine at another. The thermostat is an agent relative to the room, yet a component relative to the building-management system. A web assistant may be an agent relative to one browser task while remaining a tool within a human-led service journey. This objection is correct about scale, but it does not make the term useless. It requires the analyst to declare the environment, criterion and effect boundary before assigning the label.

The same discipline handles scheduled daemons, database triggers and event-driven services. A daemon that wakes, checks a queue and executes a fixed transaction is autonomous in the ordinary software sense. Whether it is agent-shaped depends on whether observations can change its next action and whether it reads back consequence across an episode. A database trigger may react to state without carrying a continuing objective. An event processor may preserve an objective but never observe its own effects. The component-removal test reveals the difference more reliably than product vocabulary.

There is also a legitimate broad usage in which any autonomous situated process counts as an agent, including the clockwork courier. This paper adopts a narrower engineering cut because it predicts a consequential design obligation: once actions affect later evidence, the system must manage state, uncertainty, stopping and recovery. The label is useful only when it identifies a causal responsibility that would otherwise be missed.

Part IIThe five minimum additions

Start with an arbitrary programme f. It may be a rules engine, a search procedure, a neural model or a mixture. Five additions change its role from a supplied transformation into situated, goal-directed action. Removing any one of the five produces a recognisably different system.

1. A persistent criterion

A programme normally receives a task specification with its input. An agent must carry enough of the objective to judge what to do after the first result. The criterion may say “keep the room between 19 and 21 degrees”, “reach the charging dock”, “resolve the incident or escalate”, or “collect enough evidence to answer”. It includes a stopping condition, because an endless loop is not evidence of pro-activeness.

Persistence does not mean immutability. A human may revise the task, a policy may narrow it, or new evidence may make it infeasible. The key is that the next action is evaluated against an enduring task state rather than generated as an unrelated response. A goal without a stop rule produces activity; a criterion produces controllable progress.

2. An observation interface

The system needs evidence about a world outside the policy calculation. A sensor reading, tool result, test outcome, page state or case record can serve as an observation. The interface must also say what absence means. An empty search result may mean no record exists, or merely that the query failed. A timeout may mean the action failed, succeeded late or remains unknown.

Observation is stronger than context. A prompt can contain a description of a warehouse, but a situated rover needs a current reading tied to its own position and time. The evidence may still be imperfect. Agency does not guarantee correct perception. It creates a channel through which reality can correct a plan.

3. Runtime action selection

A fixed schedule can cause effects, yet it does not adapt those effects to newly observed conditions. An agent policy chooses among available actions after the run begins. The choice may be trivial, deterministic or learned. The action set may contain “heat”, “wait”, “read status”, “run test”, “draft response” or “escalate”. What matters is that the current observation can alter which action is selected.

This is where many language-model applications qualify only weakly. A model that answers one prompt selects tokens, but the surrounding application may expose no environmental action and no continuing task. Adding function calling still does not finish the job. The application must execute a bounded operation, return a typed observation and decide what happens next.

4. An effect channel

The selected action needs a path into the environment. Sometimes the effect is epistemic: query a database, inspect a file, run a test. Sometimes it is consequential: move a robot, change a record, send a message. A proposal written into a log is not the same as an executed effect. The system boundary must state which one occurred.

For consequential work, the effect channel should sit behind a deterministic authority gate. The model or policy may recommend an operation. Identity, permission, argument validity, idempotency and limits should be enforced elsewhere. This does not make the controller less agentic. It makes its autonomy legible and bounded.

5. Temporal closure through consequence readback

The agent must learn what happened after acting. A transport-level “accepted” response may not establish the intended business state. A motor command may be blocked. A patch may compile but fail tests. Consequence readback compares the expected postcondition with an observation of the changed environment. It lets the system continue, replan, compensate, wait or admit that the outcome is unknown.

Readback closes the causal loop. Without it, action leaves the system but consequence does not return. The programme may remain automated and stateful, yet it cannot adapt to the world it is changing.

The loop can be written compactly. Let x_t be the environment state at time t. The observation function O yields o_t = O(x_t). A state updater produces m_t = U(m_{t-1}, o_t). Given criterion g, the policy proposes a_t ~ π(o_t, m_t, g). A gate K turns that proposal into an executed effect e_t, perhaps by allowing, denying or escalating it. The environment then changes according to x_{t+1} ~ T(x_t, e_t, ξ_t), where ξ_t represents disturbances outside the agent’s control.

When O(x_t) exposes everything relevant to the next decision, m_t can be trivial. When observation is partial, the agent needs a memory or belief state that summarises relevant history. This is a conditional requirement, not an excuse to call every transcript “memory”.

Goal-directedness also needs care. A designer may write the criterion, a user may supply it, or a higher-level controller may allocate it. The agent need not invent its own ends. What makes behaviour goal-directed is that the criterion constrains successive selections and terminal judgements. A system that merely prints the goal in every prompt can still wander if no runtime state checks progress against it.

Autonomy is similarly local. The policy has discretion among actions permitted by the envelope. It may decide which record to inspect or which safe route to take, while lacking permission to widen its purpose, add a new tool or change a customer record. This bounded account avoids equating autonomy with independence from human institutions. It also supports comparative evaluation: two systems can share the same goal and action envelope while differing in how much selection is fixed by workflow and how much is delegated to the policy.

The formalism exposes one further fact. Disturbance ξ_t is what makes open-loop execution fragile. If the environment transition were perfectly known and deterministic, the policy could plan once. When disturbances alter state, observation and readback acquire value. Agent architecture is justified by uncertainty entering between intention and consequence.

Thought experiment two: the clockwork courier

A courier robot is wound up each morning with a complete sequence of turns. It traverses a building without sensing anything. When the corridor is clear, it reaches the mail room. When a door is closed, it walks into the door until its spring unwinds. Is it an agent?

It has temporal persistence, an apparent goal and an effect channel. It lacks observation-dependent action. Calling it a very weak open-loop agent is defensible under a broad definition, but the label hides the precise capability engineers usually seek. It cannot be situated in the operational sense because the environment cannot correct its behaviour. The useful boundary is therefore closed-loop agency: later action is conditional on evidence returned after earlier action.

The thought experiment also prevents overclaiming. Feedback alone does not confer intelligence. The closed-loop courier may use a tiny rule table. It has gained sensitivity to consequence, not general reasoning. Agency and intelligence are related dimensions, not synonyms.

Part IIIWhat is optional, and what breaks

The minimum loop should not be confused with a modern agent product checklist. Several powerful capabilities sit above it. They improve performance in some environments and add new failure modes. Treating them as definitional makes simple agents invisible and complex workflows look more agentic than they are.

Planning is optional

A policy can map current observations directly to action. Rodney Brooks’s reactive robotics work showed that useful situated behaviour need not depend on a central symbolic world model. Planning becomes valuable when delayed consequences, dependencies or alternatives make local action insufficient. It is an enrichment of the policy, not the source of agency.

A fixed plan may also be superior in a stable environment. If every precondition is known and no observation can alter the route, replanning introduces variability without information. The correct baseline is therefore a deterministic workflow, not another elaborate agent.

Learning is optional

An agent can use a fixed policy forever. Learning changes the policy or internal representation from experience. Reinforcement learning formalises one route through repeated agent-environment interaction, but the interaction loop exists before learning is added. Conversely, a model may have learned from enormous data and still be deployed as a passive predictor with no continuing agency.

Language and reasoning traces are optional

Language models make policies more flexible because instructions, observations and candidate actions can share a textual interface. ReAct demonstrates how generated reasoning can be interleaved with tool actions and observations. Toolformer demonstrates that call placement and arguments can be learned. These are important mechanisms, yet neither a reasoning trace nor a tool call proves that a complete agent loop exists.

A system can emit persuasive plans while lacking a current world state. It can name a tool without authority to use it. It can receive a success-shaped response without verifying the postcondition. Fluency lives inside the policy; agency lives across the whole loop.

Agency is graded along separable axes

A single ladder from “non-agent” to “advanced agent” is attractive and misleading. Systems differ along several axes: duration of the episode, diversity of observations, discretion in action selection, consequence of effects, quality of outcome verification, capacity to learn and dependence on human approval. A thermostat is persistent but narrow. A coding assistant may have broad semantic discretion inside an isolated repository but no release authority. A fraud investigator may gather evidence over hours while every disposition remains a human decision.

These axes matter more than anthropomorphic surface cues. A named persona, first-person language and a conversational memory can make a component feel agentic while its actions remain a predetermined sequence. Conversely, a silent scheduler that diagnoses, chooses among recovery paths and verifies system state may instantiate stronger operational agency. The correct description should report the dimensions rather than compressing them into one flattering adjective.

Graded agency does not remove the minimum cut. It explains why borderline cases exist. A system may close the loop for information gathering but remain open-loop for consequential effects. It may preserve a criterion for one request but lose it after context compaction. It may observe current state but trust an unverified action receipt. Each case is partially agent-shaped, and each missing closure predicts a specific failure rather than a philosophical embarrassment.

The serious negative control: a world that does not change

Suppose the warehouse map is complete, no obstacles move, every action succeeds deterministically and the objective never changes. A precomputed route and a closed-loop rover reach the dock by the same path. The agent adds sensor calls, state updates and failure branches without improving the outcome. In this environment, the simpler programme is the stronger design.

This control matters because almost any task can be made to look agent-shaped by wrapping it in a loop. The loop earns its cost only when new evidence can change a material decision. Otherwise, “agent” becomes a decorative name for orchestration overhead.

Where the mechanism ceases to help

Interactive benchmarks reinforce the distinction between model competence and situated system performance. AgentBench evaluates models across several interactive environments rather than static question answering. OSWorld evaluates computer-use agents through executable tasks and reported a large gap between human and model performance in its original release. These results do not establish one universal level of agency. They show that perception, state tracking, action grounding and recovery can dominate success even when the underlying model is capable.

The same caution applies to safety. Current official work on agentic systems increasingly focuses on identity, authorisation, interoperable protocols and attacks that arrive through untrusted observations. Those concerns arise because the model is now embedded in an effectful loop. They are properties of the configured system, not of the model weights in isolation.

Part IVBuild the smallest honest agent

The most useful artefact for this argument is deliberately small. It holds the route planner constant and changes only the causal arrangement. The environment is a seven-by-five grid. Start and goal lie on a clear horizontal route. In the changing case, a pallet appears after two moves. The open-loop controller executes its original six commands. The closed-loop controller observes after every effect and replans.

while (steps < stepLimit && !atGoal(position)) {
  observeEnvironment();
  const route = breadthFirstSearch(position, goal, blockedCells);
  if (!route) return stop("blocked: no route");

  const proposedAction = route[0];
  const receipt = gateAndExecute(proposedAction);
  record(receipt);

  if (receipt.outcome === "unknown") return stop("escalate");
  // The next iteration uses the position read back after execution.
}

A production-shaped case: recovering a failed data job

A conventional retry script waits five minutes and reruns the job. That works when failures are transient. It is harmful when the upstream feed is incomplete, the prior run actually committed after a timeout, or the job version has been withdrawn. The agent-shaped design keeps the same restart command but surrounds it with an observation-action loop.

First, it admits an intent: restore the dataset to its freshness objective without duplicating a completed load. Identity binds the run to an operations service account and one job. World state contains the scheduler status, last committed partition and upstream watermark. Context contains the runbook and current release rule. Reasoning proposes the next diagnostic or recovery step. Authority limits the system to read operations and at most one restart for that job version.

Suppose the scheduler reports “failed” but the target table already contains the expected partition. Outcome evidence overrides the retry impulse, and the controller closes the incident without execution. Suppose instead that the upstream watermark is late. The controller waits or escalates because a restart cannot satisfy the objective. Only when inputs are complete, no prior commit exists and the release is valid does it propose a restart. The gateway supplies a narrow credential and stable idempotency key. Readback then checks the scheduler and target partition independently.

The agent earns its place because different observations justify different next actions. It does not earn authority by diagnosing correctly. The command remains constrained by identity, policy and effect limits. It does not declare success from the restart response; it verifies the business postcondition.

Use the ten-field control record

Once an agent can touch an organisational system, its loop should be visible as a control record. The following fields keep unlike functions separate. They also prevent the policy model from becoming the implied owner of every decision.

This record is not part of the minimal philosophical definition. It is the minimum responsible extension for effectful organisational use. The policy can remain probabilistic. The identity, authority, action and outcome records should be machine-checkable wherever the domain permits.

Test the loop by breaking it

Ordinary success cases are weak evidence because all five functions may agree when the world is cooperative. The release test should inject a different failure at each boundary. Change the objective after planning and check that stale actions are withdrawn. Return an observation for the wrong subject. Make the action gateway deny a well-formed proposal. Time out after the target system commits. Return “accepted” while the authoritative postcondition remains false. Crash after execution but before the controller records completion.

Each fault has a distinct expected response. A subject mismatch should invalidate the evidence, not merely lower model confidence. A denied action should route to a legitimate alternative or escalation, not prompt the policy to rephrase the same effect. A timeout after possible commit should create an unknown-outcome state and prohibit another write until reconciliation. A false completion signal should be caught by independent readback.

This is where the five-function synthesis becomes falsifiable. If removing consequence readback never changes safety or task utility in a representative environment, the task may not need an agent loop. If a deterministic workflow handles every injected branch under the same budget, the adaptive policy has not earned its surface. If the agent improves recovery without crossing authority gates, the mechanism has produced evidence for its intended role.

A decision instrument: should this be an agent?

The label matters because it changes architecture and assurance. Calling a fixed workflow an agent can invite unnecessary model choice and autonomy theatre. Calling an effectful loop “just a model” can hide state, authority and recovery obligations. Use the following sequence before selecting a framework.

1. Name the environmental uncertainty. State which fact can arrive only after the episode begins and which decision it can change.
2. Define the criterion and terminal states. Include success, refusal, escalation, blocked progress and unknown outcome.
3. Specify observations before prompts. Record source, subject, time, completeness and trust class.
4. Classify actions by effect. Separate inspect, test, draft, commit, communicate and compensate.
5. Keep authority outside the policy. Bind identity, purpose, resource, arguments, limits and expiry mechanically.
6. Require outcome readback. Define the authoritative postcondition and what happens when it cannot be observed.
7. Run the deterministic negative control. Use the same task data and budget. Keep the agent only when adaptation earns its added surface.

Release should widen by operation, not by a vague title such as “autonomous worker”. Begin in simulation or replay. Then allow live read-only observations, followed by drafts. Add one narrow reversible effect only after authority, idempotency, postcondition verification and containment have been tested. This staged path turns autonomy into an evidence-backed property of a specific action, not a marketing claim about the whole system.

This paper stops at the functional boundary. The later question of how reasoning and action should interleave is developed in ReAct Beyond the Prompt Pattern. The platform controls required once several specialists and services participate are developed in Anatomy of a Production Multi-Agent System.

The decision changes at the boundary

A programme does not become an agent because its code contains a large model, a planner, a memory store or a tool catalogue. It becomes an agent policy when a configured system preserves a criterion, observes an environment, selects an action at runtime, can create an effect and receives consequence as later evidence.

That boundary changes design. It moves attention away from model spectacle and towards the interfaces that make action situated: task state, observation contracts, effect channels and postcondition checks. It also makes limits visible. A reactive controller may be an agent without being broadly intelligent. A language model may be highly capable without owning a continuing task. A fixed workflow may outperform both when no material uncertainty enters during execution.

The smallest honest agent is the smallest closed loop that adaptation can justify. Build that loop, remove each function in turn, and compare it with a deterministic baseline. Add planning, learning, memory and language only when the environment demands them. Add authority only through an external gate. Call the result successful only when the world, not the policy’s prose, confirms the intended outcome.