The Agentic Spectrum
By Scott Rippey
Most people use the word "agentic" to describe anything AI-powered that seems to complete a task. That blurs together things that behave very differently. Here is what the terms actually mean, from simplest to most powerful - and why the distinction matters the moment you let any of it touch your business.
Quick reference
| Level | Name | Model decides? | Loops itself? | Risk |
|---|---|---|---|---|
| 0 | Direct chat | No | No | None |
| 1 | API / app call | No | No | Low |
| 1+ | Iterative / RLM | Shapes each pass | Dev-controlled | Low |
| 2 | Tool-use agent | Which tool | Bounded | Medium |
| 3 | True agent | Everything | Autonomous | High |
| 4 | Multi-agent | Everything + delegate | Nested | Very high |
Level 0 - Direct LLM chat
One prompt. One response. No tools, no loop.
You type a message, the model responds. The app may keep a conversation history, but the model itself never takes an action in the world. It generates text; that is the whole job.
- Who uses it: anyone talking to ChatGPT, Claude.ai, or Gemini.
- Decisions made: none. It cannot act on anything.
- Analogy: a knowledgeable advisor who can tell you what to do, but cannot pick up a tool and do it for you.
Level 1 - API / application call
A developer wraps the model in an app. Still no real autonomy.
Your app sends a structured prompt to the model, gets a response, and does something with it. The logic of what to do is written by the developer, not decided by the model.
- Who uses it: developers building products that call an LLM programmatically.
- Decisions made: none by the model. All routing and next steps are hardcoded.
- Real example: an app that sends a lead's info to the model, gets a summary back, and saves it to a CRM.
- Analogy: a vending machine. You press the button, it dispenses the item. No judgment involved.
Level 1+ - Iterative API / RLM pattern
The loop exists, but the developer wrote it. The model runs inside it, not above it.
The developer's code owns a loop. Each pass calls the model, evaluates the result, and decides whether to call again. The model can shape how useful each pass is - refining a query, narrowing a search - but it cannot decide on its own to keep going or stop. Control never leaves the code.
- Who uses it: teams building retrieval systems, RAG pipelines, and knowledge-base lookups.
- Loop behavior: developer-controlled. It can run many passes, but the exit condition always lives in code.
- Analogy: a manager who keeps sending a researcher back until they find the answer. The researcher does not decide to keep searching - the manager does.
Level 2 - Tool-use / ReAct agent
The model chooses what to do next. This is where "agent" starts to earn the name.
You give the model a goal and a set of tools - search the web, query a database, send an email - and it reasons about which tool to call, calls it, sees the result, and decides what to do next. Reason, act, observe, repeat.
- Who uses it: workflows where the model needs to make routing decisions.
- Decisions made: which tool to call, what to pass it, and whether to keep going or return an answer.
- Loop behavior: real, but bounded - it iterates until it has an answer or hits a limit.
- Analogy: a personal shopper with your list and a store map. They pick the route and order, but you triggered the trip.
Level 3 - True agentic system
Sets its own subgoals. Decides when it is done. Operates across time.
You give it a high-level objective. It breaks the goal into subgoals, plans a path, takes actions, checks its own results, self-corrects when something fails, and decides on its own when the task is complete. It is not re-triggered by a human at each step.
- Who uses it: engineers building autonomous systems.
- Decisions made: what subgoals to create, what order to pursue them, when to retry, when to escalate, and when to declare the job finished.
- Analogy: hiring a contractor and handing over the blueprint. They assess, plan, build, test, and tell you when it is done.
Security: this is where permissions start to matter seriously. The agent makes its own decisions across many steps, so a misconfigured permission is no longer a one-time mistake - it can cascade. Apply least privilege, sandbox anything touching production or sensitive data, and add human checkpoints at irreversible actions like deploys, deletes, or external sends.
Level 4 - Multi-agent / orchestrated agents
An agent runs other agents. This is where serious power - and serious risk - lives.
A top-level orchestrator receives a complex goal, breaks it into parallel or sequential workstreams, and delegates each to a sub-agent. Each sub-agent runs its own loop. The orchestrator collects results, resolves conflicts, and synthesizes the final output.
- Who uses it: advanced systems where one model coordinates several specialized ones.
- Loop behavior: nested. The outer agent loops over sub-agents; each sub-agent runs its own internal loop.
- Analogy: a general contractor managing specialists - electricians, plumbers, framers. Each runs their own work autonomously; the GC coordinates the whole build.
Security: sandboxing and siloing are no longer optional here. A bad permission on the orchestrator propagates to every sub-agent it spawns. Think in blast radius: if one sub-agent goes sideways, what can it reach? Scope each agent to only what its task needs, keep human checkpoints at high-stakes actions, and treat audit logging across the chain as a baseline, not an afterthought.
Why this matters
The higher the level, the tighter the permissions must be. An automation with bad permissions does one wrong thing. A true agent with bad permissions can chain ten consequential actions before anyone notices. Design for least privilege, define the blast radius, sandbox the environment, and add human checkpoints at anything irreversible - deletes, sends, deploys, payments.
The single question to ask when evaluating any "AI agent" product or workflow:
Can the system decide to do something you did not explicitly program it to do?
If no, it is an automation. Powerful, useful, but not agentic. If yes, it is at least agent-adjacent - and the higher up the spectrum it sits, the more seriously you need to think about what it can reach.