Over the last two years almost every company has bought a chat with a language model. Many have added their own documents through a RAG system. Few have seen the way they work actually change: people use the chat to write an email and the RAG to look up documents, and the work itself stays the same. It doesn’t get better.
Agentic systems are the next step. An agent doesn’t answer: it receives a task and sees it through. In this article I’ll talk about who does the work, who checks it, what it costs and who is accountable for it. If what you want to know is how an agent is built, that’s in How to write an agent .
Three levels, one question: who does the work?
A chat is a turn: question, answer, and the initiative goes back to whoever is typing. RAG is a chat that searches the company’s documents before answering: the answer is grounded, but it’s still an answer. An agent is a loop: it reads, decides, acts, checks, and starts over until the goal is reached or until it runs into something it can’t resolve on its own.
With chat and RAG the work is done by the person, with help. With an agent the work is done by the system, and the person decides, checks and signs off.
The case: a customer’s security questionnaire
Take a job that exists in every company selling to enterprise customers: the infamous security checklist. It arrives as an Excel file with 180 questions, it has to go back within two weeks, and the answers have to be consistent with the policies, with the certifications and with what was answered to the same customer last year.
Let’s call the company CesellatoriDiByte SpA, a vendor of management software: the company is made up, the process is not. At CesellatoriDiByte SpA the questionnaire is filled in by Elena, the IT manager, over three evenings, digging through the policies, asking legal, copying from last year’s questionnaire and hoping nothing has changed in the meantime.
With a chat, Elena gets well-written, generic answers: the model doesn’t know the company’s policies. With RAG, she can ask question by question, “what does our policy say about backups?”, and get the right passage. A hundred and eighty times.
With an agent, Elena starts an execution: “Fill in the attached questionnaire using the policies, the certifications and last year’s answers. For each answer give the source. Flag the questions you can’t answer.” Then she goes and does something else. The agent reads the file, looks up the sources, writes the answers into a working file, checks that every answer cites a real source, and in the end hands her a completed questionnaire with twelve questions marked “to be decided”, for instance the ones about new contractual clauses.
Elena no longer wrote 180 answers. She decided on twelve, checked and signed off on the rest. That is the difference, and it has precise consequences.
What really changes
The unit of work becomes the outcome
With a chat you judge the answer: is it clear, is it right, is the tone right. With an agent you judge the outcome: is the questionnaire complete, consistent, grounded in the sources, properly formatted. How you measure changes too. Not “how many questions did the user ask the model” but “how many questionnaires went out, in how much time, with how many failed checks and how many questions left open”.
This makes the investment something you can evaluate. A chatbot used for emails has no measurable return. An agent that returns questionnaires in a day instead of three evenings does, and you can see it in the execution log.
Whoever writes the agent is not whoever uses it
In an agentic system the agent is defined once and launched many times. In AIDeskPro the definition is called a Configuration: role, rules, which resources it may use. The launch is called an Execution: the configuration applied to the documents of that particular case.
This separation is organizational before it is technical. The Configuration of the “questionnaire filler” is written by someone who knows the policies and the rules, say Elena together with legal. It is launched by whoever receives a questionnaire, even a salesperson, with no need to know how to write a prompt. For the first time IT governs what the AI is allowed to do, and users use it without having to become experts (a real case is our marketing team, which runs our website through an agent).
Documents become an asset, with permissions
An agent is worth as much as the sources it can reach. CesellatoriDiByte’s questionnaire comes out well because the policies, the certifications and the past questionnaires sit in curated document indexes, not scattered across personal folders. Companies that start with agents quickly find out that the real work is putting their documents in order.
And permissions matter more than before. An index holding the contracts must not be visible to every agent nor to every user. In AIDeskPro indexes are shared by group, agents receive them as explicit resources, and model permissions are assigned per user group. Whoever launches an execution cannot let the agent read what they couldn’t read themselves.
Control moves from the text to the checks
Nobody rereads 180 answers carefully the third time around. With an agent, human control changes shape: you don’t reread everything, you define beforehand what “wrong” means and let an independent verification step look for it. For CesellatoriDiByte: every answer cites a source that exists; no answer contradicts last year’s without a note; questions without a source are flagged, not invented.
The check is done by a step separate from whoever wrote the answers, a verification phase or a sub agent, because whoever wrote a wrong answer tends to confirm it. The person looks at the failed checks and the open questions. Twelve decisions instead of a hundred and eighty rereads.
Every execution has a cost, and you can see it
A chat costs little and predictably. An agent makes dozens or hundreds of calls to the model per execution, and the cost depends on how much work there is. That’s fair, but it has to be visible. In AIDeskPro a dashboard shows daily costs by user label, by execution and by model, with thresholds and alerts. CesellatoriDiByte’s questionnaire costs a few euros of model time: less than an hour of Elena, but it’s a number the CFO wants to know beforehand, not on the invoice.
Traceability is not optional
When the system executes, someone will ask “why did it answer that way?”. A serious agent leaves a trail: the Console shows every step, every file read and written, every question asked of the user, and lets you stop and resume the execution. The working files stay in the Workspace and can be opened, corrected and downloaded.
On the AI Act and GDPR front, this trail is the material you work with: traced steps, data that stays in Europe, the final decision left to a person. These are mechanisms, not guaranteed compliance. Check them with your legal team against your own case.
Someone signs off
The last thing that changes is the simplest. With a chat, accountability stayed implicit: the person wrote, the person answered. With an agent it has to be made explicit: who decides whether the questionnaire leaves the company? At CesellatoriDiByte it’s Elena, who opens the file, looks at the twelve open questions, closes them and sends. The agent sends nothing. This rule, written into the Configuration, is worth more than any disclaimer.
Where an agent isn’t needed
If the task is a question, RAG is enough, and AIDeskPro’s RAG has nothing to fear from the competition. If it’s writing an email, a chat is enough. An agent makes sense when the work is repeated, has several sources, several steps and a result that needs checking: a questionnaire, a quote, screening a hundred CVs, reading a tender specification. A one-page summary, no, and it costs more.
There is also a case where you’re not ready: when you can’t say what “a wrong result” means. If Elena can’t list the checks, the agent will produce plausible answers that nobody will be able to challenge. Better to wait and write the criteria first.
Where to start
- Pick a process with several sources and a final check, that today someone does by hand and reluctantly. Customer questionnaires are a good candidate: repetitive, documented, with a deadline.
- Put the sources in order. One index for policies and certifications, one for past answers. With the right permissions.
- Write the mandate as you would for a new colleague: what to produce, from which sources, what never to do, what to flag instead of inventing.
- Write the checks before the first launch. Then launch on a real case and look at the failed checks, not at the text.
- Decide who signs off, and write it into the Configuration.
A long-term example of this approach is the websites Open Gate runs with AIDeskPro CMS agents: opengate.biz, 299 pages in two languages with content going back to 2014, was migrated from WordPress to Hugo by an agent in one working day, with one person rereading the pages, and today changes are requested in chat and go to production only after a human ok.
FAQ
Does an agentic system replace RAG?
No, it uses it. Document indexes are one of the resources the agent has access to. RAG remains the right way to ask a question; the agent is the way to get a job done.
Do you need a development team to build an agent?
Writing a Configuration takes someone who knows the process and the rules, not a programmer. Launching an execution only takes knowing what you want to get.
How do you measure whether it works?
Outcomes per execution, time between launch and delivery, failed checks, questions left open, cost per execution. All numbers that a Console and a cost dashboard show without estimates.
What happens if the agent gets it wrong?
It gets it wrong inside a sandbox, on working files, and the independent check catches it in most cases. The rest is caught by whoever signs off. No result leaves the company without a human decision, if the Configuration says so.
Does the data stay in Europe?
In AIDeskPro hosting is in Europe, in a project dedicated to the customer, with zero data retention on the default models and no training on customer data. On-premise versions exist for those who need to keep everything in house or on providers not subject to the Cloud Act.
Further reading
How an agent, its resources and its checks are built is in How to write an agent . Use cases, plans and frequently asked questions are on the AI agents for business page. The rest you understand by launching a first execution on a real process.