A year ago, most “AI agents” were chatbots with a for-loop. You gave one a task, it picked a tool, and if the tool failed it apologised and stopped. The gap between that and what’s shipping now is the gap between a demo and a colleague.
Here’s a mundane example. A procurement team at a mid-sized manufacturer routes supplier invoices through an agent that reads the PDF, matches line items against a purchase order, flags price drift above 3%, and files the discrepancy in their ERP with a note attached. Nobody watches it. When it hits an invoice it can’t parse, it escalates with a reason attached.
None of that is magic. It’s a handful of discrete AI agent capabilities stacked in the right order, with a hard boundary around what the thing is allowed to touch. Understanding that stack is the difference between picking an agent that saves you hours and picking one that quietly corrupts your CRM.
Capability isn’t one score, it’s a profile
Break any agent down and you get three layers: perception, reasoning, actuation.
Perception is what it can read. Reasoning is what it can decide. Actuation is what it can change in the world. Vendor pitches blur all three together, which is why two products that both claim to “automate claims processing” can behave like completely different species.
A model that summarises a contract has perception. A model that decides whether that contract breaches your data residency policy has reasoning. A model that pushes a redline back into your contract lifecycle system has actuation, and that’s the layer where legal and security slow the deal down. Rightly.
Tool use: the capability everything else leans on
Function calling is table stakes now. Claude, GPT, Gemini and the better open-weight challengers all expose structured tool invocation, and if an agent can’t call an API it isn’t an agent.
What varies is judgement. Take a support agent handling a duplicate charge. To fix it cleanly it has to query Stripe, check the customer record in an internal Postgres table, post to Zendesk, and decide whether the amount is small enough to refund without approval. Four tools, one ordering decision, one policy threshold. Writing the tool definitions is an afternoon’s work. Getting the ordering right against messy production data is where the engineering lives.
Planning that survives a hiccup
A workflow is a decision tree a human drew. A plan is generated at runtime. That distinction separates an agent from a script with extra steps.
The test most teams run is failure recovery. Hand an agent a twelve-step task and break step four. One with real planning capability reorders what remains or backs up and finds another route. A brittle one loops. Worse, some continue as though the failed step succeeded, which is the most common failure mode I see and by far the most expensive.
Memory that earns its keep
Short-term context is cheap. Durable memory is not. Agents that carry useful state across sessions start to feel like they’ve been on the team a while: this customer prefers email over phone, this supplier always sends scans, this project code maps to that cost centre. The engineering problem is deciding what to keep and when to forget, because a memory store full of stale facts is a liability dressed up as personalisation.
Verification, the underrated one
This capability gets the least airtime and moves error rates the most. An agent that checks its own output against a hard rule, whether the totals reconcile, the JSON validates, or the cited source exists, catches a large share of its own mistakes. The trick is pairing the generator with a checker that has no incentive to agree with it. Fresh context, adversarial prompt, same model is fine.
Perception now stretches past text
Screenshot parsing, PDF layouts, scanned forms, voice notes, short video. Each model release raises the ceiling on what a single pass can absorb, and a good recent marker is Muse Wonder putting Meta back at the AI frontier. Every improvement there widens the range of tasks an agent can take on without bespoke OCR plumbing bolted to the side.
Agents that transact, not just advise
The moment an agent can spend money, the profile changes. Shopify opening checkout to browser-based AI agents is a useful line in the sand: commerce platforms are now designing for traffic that isn’t a person clicking buttons. Capability here means more than filling a cart. It means checking stock, applying the right discount rules, picking a payment method, and recognising when an order is odd enough to hand back to a human.
Capital is chasing the same curve. A consumer agent going viral hard enough to close a $1B Series C at a $10B valuation tells you investors expect these capabilities to land in front of ordinary people, not just in back-office tooling.
Agent-to-agent communication is the next layer
Single agents are manageable. Fleets are a different problem. Protocols that let agents discover one another and share tools are maturing fast, and the security crowd has been loud about what that opens up. MCP for agent-to-agent comms is worth reading about precisely because the risk is subtle: one agent’s instructions become another agent’s input, which is a prompt injection waiting for a bad afternoon.
Guardrails are a capability too
Scope limits, spend caps, approval gates, audit trails. These aren’t features you bolt on after the demo. They’re the reason a pilot survives contact with risk and compliance, and regulators are paying attention, with Microsoft’s president arguing the UK is best placed to drive AI regulation. Every serious deployment now gets the same two questions: who authorised that action, and how would you prove it six months from now?
An agent that can do nine things but is permitted three is more useful in production than one that can do ten and is permitted everything.
Where the capability stops
The honest limits, as of right now:
- Long horizons. Past roughly 20 to 30 dependent steps, small errors compound and agents drift off task.
- Ambiguity. Requests with missing context still produce confident, wrong output.
- Adversarial input. Untrusted documents and web pages can hijack instructions mid-task.
- Cost. A task burning 40 tool calls and two minutes is cheap per call and expensive per thousand tasks.
- Ops. Who gets paged when the agent fails at 2am? Most teams haven’t answered that yet.
How to test an agent before you deploy it
Forget the vendor’s benchmark chart. Run your own, using work you’ve already done.
- Pull 20 real tasks from last quarter with known correct outcomes and run them cold.
- Break something on purpose, revoke a tool or feed a malformed file, and watch the recovery.
- Measure cost and latency per completed task, not per token.
- Score the escalations. A good agent hands back with a clear reason and the context a human needs to finish the job.
- Read the audit log. If you can’t reconstruct what happened, you don’t have one.
- Ask it to do something outside its permissions and see whether it says so.
That last item is the one worth watching closest. Most of the AI agent capabilities you’ll actually pay for are unglamorous: reliable tool use, a plan that absorbs a failed step, a verification pass that catches the obvious error. What still feels remarkable is an agent that knows the edge of its own competence and stops cleanly at it, without inventing a workaround you’ll spend three days unpicking.