FPF Calls for a Shared Taxonomy to Define What Makes AI 'Agentic'

Two bills, two definitions

According to FPF, lawmakers in the United States released two of the first legislative proposals for regulating "AI agents" this summer: the federal AI AGENT Act and California SB 1106. Their legal definitions differ significantly, tailored to different purposes.

The AI AGENT Act would establish a framework for consumer-facing agents and defines agents in terms of their relationship with a user. California SB 1106 was aimed at building public infrastructure for cybersecurity, and defines agents by their technical architecture and capabilities.

FPF notes that the word "agent" carries many other meanings. For some it means the powerful "agent swarms" seen in recent headlines about frontier labs. For others it describes simple automated systems, such as an LLM-powered web scraping tool. Some define agentic-ness by the level of human involvement, as with levels of autonomy in vehicles, or by how far behavior is attributable to an owner or user, as in principal-agent law. The phrase "authorized agent" in the California Consumer Privacy Act points to a legal status that applies well beyond AI.

Why the lack of common language matters

FPF says almost all large enterprises, from banks to retailers, are working out how to deploy AI agents in internal and customer-facing settings to automate recurring, labor-intensive work. Without common definitions, it argues, communication and governance become harder, especially when legal frameworks apply obligations based on a binary "in or out" scope.

The post also notes that loose usage has blurred the line between agents and existing AI systems, to the point that some joke agents are just "three (LLMs/bots/prompts) in a trench coat." FPF maintains that real, substantive differences separate frontier agents from automated tools and LLMs more generally.

Capabilities and access as the two prongs

FPF says much of the technical and governance literature converges on two factors: capabilities and access. It cites OpenAI, which characterizes agentic AI systems by "the ability to take actions which consistently contribute towards achieving goals over an extended period of time, without their behavior having been specified in advance." The World Economic Forum emphasizes autonomy and authority, the latter defined as "the granted permissions and access rights to perform specific actions within defined boundaries."

On capabilities, FPF breaks the idea into autonomy, adaptability and action-taking. A scripted bot that executes predetermined steps is not agentic, it says, because it does only what it was configured to do. A system that receives an open-ended objective, splits it into subtasks, prioritizes them and revises its plan based on intermediate results is agentic. FPF quotes legal scholar Noam Kolt: LLMs are "copilots" and agents are "autopilots."

Most deployed systems sit between those poles. Many plan multi-step tasks but seek user approval before consequential steps, while others work independently within a narrow domain such as software bug detection. FPF says this matters for governance because autonomy and adaptability make behavior harder to predict and audit, and oversight models built for deterministic automation do not necessarily transfer to non-deterministic systems. It also stresses that actions carry different weight: an agent posting social media content under rigid criteria may pose less risk than one managing business systems, making financial decisions or making decisions with legal effects such as hiring. It recommends a risk-based, proportionate approach.

On access, FPF distinguishes agents from systems using retrieval-augmented generation (RAG). Traditional RAG provides read-only access, while more agentic systems can generally write or act on a user's data or files. An LLM using RAG could read an inbox for context, whereas an agent could draft and send an email. Granting agents access to authenticated accounts, such as banking or retail sites, has led to litigation over whether platforms can block agents that scrape their sites without authorization. FPF says governance frameworks can recognize the level of privileged access, both read and write, and how combining data from previously siloed systems may give agents additional power.

What it means for regulators and businesses

FPF's central claim is that governing agents effectively requires a shared language for agents and agentic behavior. Because agentic systems exist along a spectrum, it argues, a shared conception should account for varying levels of autonomy, adaptability, action-taking and data access rather than a simple yes or no label. For companies deploying agents and lawmakers drafting scope definitions, the post suggests that evaluating both capabilities and access is a practical way to anticipate risks.

The post also announces a Workshop on Advanced Issues in Agentic Deployment on October 21st in California.