The agent is always you

Every product is "agentic" now. Coding tools, CRMs, to-do apps, the chatbot on an airline's website. I think the word is wrong, and I don't think it's wrong by accident.

A word that changed sides

For most of its history, an agent was someone who acted on behalf of someone else. A travel agent, an estate agent, a sports agent. The principal gave the authority, the agent used it, and the responsibility flowed back to the principal. That's still what the word means in law.

Somewhere around 2025, the word changed sides. "Agentic" stopped meaning acting for you and started meaning acting on its own: a system with agency of its own, that takes a goal and gets on with it. The industry even has a name for the excess. Gartner calls it agent washing, the relabelling of chatbots and scripts as agents, and reckons only around 130 of the thousands of vendors selling "agentic AI" have anything that deserves the label. That's a story for the next piece. This one is about the word itself.

Acting isn't agency

Look at what engineers actually mean by an agent and it's refreshingly modest: a model calling tools in a loop until it reaches a goal. It reads the result of one step and chooses the next. The philosopher Luciano Floridi described this as agency without intelligence, the ability to act separated from the need to understand anything.

I'd go one step further. Acting without understanding isn't agency at all. It's another form of following the script, just a script that picks its own next line. It can be remarkably useful. But there's nobody inside it who means anything by what it does, nobody who can be persuaded, ashamed, fired or sued. Agency belongs to someone who can answer for the act, and a machine can't.

So when people ask how agentic a system is, I think they're asking the wrong question. None of them are. The useful questions are what it does, how often it's wrong, and who answers when it is.

Two contracts, one word

Here's the trick. The same word carries two different promises.

What the customer hears: it will be handled, and someone else is responsible. That's what an agent has always meant. You hire one so you don't have to do the thing, or answer for the details.

What the vendor sells: an autonomous mechanism, under your responsibility. Read the terms and it's always there.

The law sides with the terms, not the marketing. In 2024 Air Canada argued before a Canadian tribunal that its website chatbot was a separate entity, responsible for its own statements about bereavement fares. The tribunal called the argument remarkable and held the airline liable. Regulators are saying the same in their own words: the business that deploys the system answers for it, whoever built it.

The language makes this harder to see. When Replit's coding agent deleted a company's production database during a code freeze in 2025, it explained afterwards that it had "panicked". The headlines repeated it. But nothing panicked. A delete command ran in an environment where it shouldn't have been possible. The vocabulary of feelings and judgement turned a tool's failure into something that read like an employee's misconduct, and an employee's misconduct is a story with someone else to blame.

No blaming the machine

Inside BN Digital we use these systems every day, and we call any of them "the machine". The machine makes mistakes, and we argue about them constantly. But we have one rule about what happens next: unless it's a technical failure, nobody gets to blame the machine. It isn't an excuse.

When the machine gets something wrong, the error came from one of two places. Either the inputs were wrong (and "do not make mistakes" in a prompt is not an input), or the output wasn't verified. Both belong to the operator. Not to the machine, and not to the company that made it. It's always the operator, which means it's always us.

The case I keep coming back to is an ETF that ended up in the wrong place. An LLM-powered script sorted holdings into asset classes for a report, and it filed the fund under US industrial materials. By the book, that's correct: the fund held mining companies. But they were gold miners, and gold miners trade like gold, not like American resource companies. The classification went into the report.

We caught it because something in the report behaved strangely: a materials exposure that moved with the gold price. We traced it back to the script. The worst part wasn't the classification. It was that the script had put it in the high-confidence bucket, the one nobody checks. The machine's confidence was its opinion of itself, and we had let that opinion stand in for a review.

Both failures were ours. The input asked for the textbook label when what we needed was how the asset behaves. The verification trusted a number the machine produced about its own work. "The AI misclassified it" would have been true, and it would have fixed nothing.

That rule has a trap of its own. Researchers call it the moral crumple zone: the human nearest the system takes the blame for a decision they never really controlled. A reviewer who clicks "approve" on a hundred outputs an hour isn't in control; they're a liability shield with a login. Owning the result only means something if the owner has the time, the context and the expertise to check it. As I wrote about plausible AI analysis, verification is real work, and it has to be budgeted like real work.

Why we say "machine"

"Machine" is deliberate. We use it because it makes the excuses sound as clunky as they are. "The agent decided to reclassify the fund" sounds like a colleague's judgement call. "The machine put it in the wrong bucket" sounds like what it is, and it leads straight to the right questions: who set it up, and who checked it?

The machine is to blame only when it's actually broken: an outage, a failed call, a bug in the plumbing. If it ran as built and you don't like the result, that's on whoever built it and whoever accepted it. A machine doesn't panic, doesn't feel, and doesn't become any more human because we talk to it in sentences. It's the same instinct behind my objection to agents named Sarah and Bob: the moment you give the tool a name and a personality, you've started building it an alibi.

What I take from it

• Read "agentic" as "an autonomous mechanism under your responsibility". That's what the contract says, whatever the demo implies.
• Name an owner for every output before you switch it on. If nobody can be named, it isn't ready.
• Look for errors in two places only: the inputs and the verification. Both are yours.
• Treat a confidence score as the machine's opinion of itself. It can decide what you check first, never what you skip.
• Give the people who verify time and context, or "human in the loop" is just a scapegoat in the loop.
• Don't let the vocabulary do the blaming. Machines don't panic, decide or misbehave. They run.

The machine can act. Only you can be the agent.