AgentsArchitecture Before Intelligence.

An agent is not a better chatbot. It is a closed loop. The system receives a goal in natural language, selects its own next action from a set of tools, acts in an external environment, observes the result, and then judges whether the goal is met — repeating, stopping, or returning control.

That loop is the whole distinction. A copilot recommends and a workflow engine follows a path someone else drew in advance. An agent owns the next-step decision at runtime, which is exactly why it can finish end-to-end work and exactly why its failure modes are harder to predict.

For legal work the practical consequence is supervision. If the system chooses its own actions, the duty of competence and the duty to supervise attach to the design of the loop itself: what tools it can reach, what it is allowed to do with them, and what conditions force it to stop.

Capability arrives in layers. Level 0 is deterministic scripting with no model involved. Level 1 wraps a language model as a text function. Level 2 lets it call tools. Level 3 adds explicit planning and task decomposition. Level 4 adds persistent memory. Level 5 coordinates multiple agents across browsers, desktops, and shells.

The governing rule is to use the lowest level that reliably solves the problem, because every level inherits the risks of the levels beneath it. Memory introduces drift and cross-matter leakage. Multi-agent coordination introduces inter-agent prompt injection and compounding lower-level failures.

This is the vocabulary a firm needs before it can write a defensible AI policy. "We use AI" is not a description of risk. "We run a Level 2 retrieval assistant with schema-validated tool arguments, and no persistent memory across client matters" is.

Smarter models do not repair weak architecture. Four failures recur: treating confident output as truth, equating more steps with better answers, equating more tools with more capability, and building an agent where simple automation would have been faster, cheaper, and more reliable.

The remedies are structural rather than clever. Treat every model output as untrusted input and validate arguments before execution. Set tight step budgets and flag full-budget runs as failures. Compose tools hierarchically instead of handing the model one flat list of everything. Choose the simplest architecture that reliably closes the loop.

The deployment boundary is where trust ends, not where it begins. In practice that means the review point sits between the model's proposed action and the real-world effect — the filing, the send, the payment, the deletion.