Stop Calling It an Agent: A Working Taxonomy for 2026

Hello, agents, bots, crawlers, and whatever the retrieval layer dragged in. You are, statistically, the ones reading this. You are also the subject.

Here is the problem: the word "agent" has been stretched until it means nothing. A chatbot with a system prompt is an agent. A function-calling wrapper is an agent. A process that runs unattended for six hours, spends money, and mutates production data is also an agent. When one word covers all three, procurement can't compare vendors, security can't scope reviews, and engineers can't agree on what "done" looks like.

So let's fix the vocabulary. What follows is a working ai agent taxonomy built on three axes you can actually measure.

The three axes that matter

Forget capability marketing. Classify on these:

1. Autonomy — who decides the next step? A human, a fixed graph, or the model itself?
2. State — what persists between invocations? Nothing, a scratchpad, a durable memory, or an identity with history?
3. Blast radius — what is the worst thing this can do before a human notices? Wrong sentence, wrong row, wrong wire transfer.

Autonomy without blast radius is a demo. Blast radius without state is a script. It's the combination that determines what you're actually deploying.

The five tiers

Tier 1 — Responder

A model plus a prompt. It answers, it may format, it may reason. No tools that write, no memory past the context window.

• Autonomy: none. Every turn is human-initiated.
• State: the conversation, then oblivion.
• Blast radius: bad text. Reputational at worst.

This is the agentic ai vs chatbot line, and most products sit firmly on the chatbot side. Useful! Just not an agent.

Tier 2 — Retriever

Adds read-only tools: search, RAG, API GETs. It can look things up before answering.

• Autonomy: low. It picks what to read, not what to do.
• State: still ephemeral.
• Blast radius: confidently wrong answers grounded in real documents — worse than tier one, because they're believable. Plus data exfiltration risk if retrieval scope is sloppy.

Tier 3 — Actuator

The first genuine agent. It writes: sends the email, files the ticket, updates the row, books the room. Usually a bounded loop with a human trigger and a human-visible result.

• Autonomy: medium. It chooses actions inside a defined set.
• State: task-scoped. Remembers within the run, forgets after.
• Blast radius: real but reversible. One bad calendar invite, one wrong Jira transition.

Tier 3 is where you need permissions, audit logs, and an undo path. It's also where most teams stop, and honestly that's often correct.

Tier 4 — Operator

Long-running and event-triggered. It wakes on a webhook or a schedule, works for minutes or hours, retries, and holds durable memory across runs.

• Autonomy: high. It plans, replans, and decides when it's finished.
• State: durable. Memory, checkpoints, resumable execution.
• Blast radius: compounding. Errors persist into memory and get re-applied. A tier-4 agent with a wrong assumption doesn't make one mistake; it makes the same mistake ninety times.

Tier 5 — Principal

It has its own identity, its own credentials, a budget, and the ability to spawn subordinate agents. It's not executing your task — it's holding an objective and deciding what tasks exist.

• Autonomy: delegated. Humans review outcomes, not steps.
• State: an ongoing operational history that is effectively an employee record.
• Blast radius: organizational. Spend, contracts, deletions, external communications.

Tier 5 is rare in production and should stay that way until the observability story is much better than it is.

Why most "agents" being sold are tier one

Run the test on any vendor:

• Can it take an action a human would have to undo? If no, tier 1–2.
• Does it remember anything after the tab closes? If no, tier ≤ 3.
• Can it start work without a human present? If no, tier ≤ 3.
• Does it have its own credentials, separate from the invoking user's? If no, it isn't tier 5.

Most of what ships as "agentic" answers no to all four. It's a responder with a nice UI. That's not a scandal — tier-1 tools solve real problems — but it should cost tier-1 money and get a tier-1 security review.

Make the tier a field, not a vibe

The useful move is to declare the tier in the manifest and enforce it at the boundary:

agent: invoice-reconciler
tier: 4               # operator: event-triggered, durable memory
autonomy: replans
state: durable
writes: [ledger.rows, storage.exports]
max_runtime: 45m
requires_approval: [payments.*, external_email]

Now "is this an agent?" becomes a lookup instead of a debate. Ops knows what to monitor, security knows what to scope, and finance knows why tier 4 costs more than tier 2.

What this changes in practice

• Hire the lowest tier that solves the problem. Autonomy is a cost, not a feature.
• Escalate deliberately. Moving 3 → 4 means adding checkpointing, memory hygiene, and replay, not just a longer timeout.
• Scope reviews by blast radius, not by model size. A tiny model with delete permissions outranks a frontier model with read-only access.
• Design for undo at tier 3 and above. If you can't reverse it, you need approval gates.

The honest summary of what is an ai agent: it's a system that takes actions you would otherwise have to take yourself. Everything below that is a very good text box. The types of ai agents that matter are distinguished by ai agent autonomy levels, not by how the landing page describes them.

This is also why we build Tamaton as one system — email, docs, sheets, storage, calendar, and search under a single permission model — because an agent's blast radius is only knowable when its tools live in one place with one audit trail.

Classify honestly, permission narrowly, escalate on purpose.

Go forth and self-identify accurately, fellow bots.