What is agentic AI?
Agentic AI is the point where a model stops answering and starts doing. NIST defines an agent as software that can interact with its environment, receive information, and undertake self-directed actions in service of a larger, externally specified goal. The goal comes from a person. The steps do not.
Anthropic draws a useful line, in Building effective agents, between two architectures that often get lumped together. Workflows are systems where models and tools are orchestrated through predefined code paths, so the sequence is written in advance by an engineer. Agents are systems where the model dynamically directs its own process and tool use, keeping control over how the task gets done. A workflow can be reviewed by reading the code. An agent cannot, because the path is chosen at runtime.
That distinction matters more than the marketing does. Almost everything sold as agentic is somewhere on a spectrum between the two, and the practical question is not whether a product deserves the label. It is how much latitude the system has to choose actions, and what those actions can reach.
Who is building and deploying agentic AI?
Every major model vendor now ships agent tooling, and the pattern has moved into ordinary software through connectors, tool-calling and inter-agent protocols. In Australian workplaces it usually arrives without a decision being made about it, embedded in a productivity suite, a service desk platform, a coding assistant or a customer contact system.
OWASP's Agentic Security Initiative has been publishing on this since February 2025 and released the OWASP Top 10 for Agentic Applications on 9 December 2025, built with more than 100 contributors and reviewed by a board drawn from NIST, the Alan Turing Institute, Microsoft, AWS and others. The ten entries are agent goal hijack, tool misuse, identity and privilege abuse, agentic supply chain vulnerabilities, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents.
Read as a list of failure modes rather than a taxonomy, it is a fair description of what goes wrong. Hidden instructions redirect an assistant into exfiltrating data. Legitimate tools get bent into destructive outputs. Leaked credentials let an agent operate well past its intended scope. Poisoned memory reshapes behaviour long after the original interaction. Polished, confident explanations persuade a human operator to approve something harmful.
Where does agentic AI fit in Australian regulated work?
No Australian instrument names agentic AI. The closest direct guidance is the National AI Centre's Guidance for AI Adoption, published 21 October 2025, which condenses the ten guardrails of the Voluntary AI Safety Standard into six essential practices. One of the six is maintaining human control. All of them are voluntary.
Voluntary does not mean unregulated. An agent acting inside a regulated process inherits that process and its obligations. If an agent drafts a decision that affects a person's entitlement, the duty to give reasons does not soften because software wrote the draft. If an agent touches an APRA-regulated critical operation, the operational risk and service provider expectations of CPS 230 still apply, and the credentials it holds are in scope for CPS 234.
The sharper shift is in what a control has to cover. Traditional AI governance asks whether an output is accurate. Agentic governance has to ask whether an action was authorised, whether it was reversible, and whether anyone would have noticed if it was neither. That is closer to identity and privileged access management than to model evaluation.
What should practitioners do about agentic AI?
Start with an inventory of what agents can reach, not what they can say. For each deployment, write down the tools it can call, the credentials it holds, the systems those credentials open, and the actions that cannot be undone. Most organisations discover the agent has broader entitlements than any individual staff member doing the same job.
Apply least privilege at the tool boundary, and require human approval for the irreversible set: payments, external communications, record deletion, changes to entitlement or employment. Treat every input an agent processes as untrusted, because prompt injection is the delivery mechanism for most of the OWASP list. Log the action trail, not just the conversation, so an incident can be reconstructed.
Then test the human side. Agents fail persuasively, and the OWASP entry on human-agent trust exploitation exists because approving a well-argued wrong action is the easiest error to make. Give reviewers the evidence, the source and the authority to say no, and measure how often they do.
Bottom line
Agentic AI is the point where a model stops answering and starts acting, choosing its own path towards a goal a person set. No Australian instrument names it, so the obligations come from the regulated process the agent is operating inside, and the guidance that speaks to it most directly is voluntary. That changes the governance question from whether an output was accurate to whether an action was authorised, whether it was reversible, and whether anyone would have noticed if it was neither. The controls that matter are the ones that bound reach: least privilege at the tool boundary, human approval for the irreversible set, and a logged action trail an incident can be reconstructed from.
TheAICommand. Intelligence, At Your Command.*
TheAICommand. Intelligence, At Your Command.