AI agents have moved out of the demo and into the workday. This is a short field guide to what they are, where they already work, and why I think security belongs inside the loop.
What an agent is
A chatbot gives you an answer. An agent takes the answer and acts on it. It reads what is in front of it, keeps some memory, plans steps toward a goal, and then uses tools: a browser, a spreadsheet, an API, a shell. Tool access is what turns a model that talks into a model that does.
The main kinds
Textbooks sort agents by how they choose. A simple reflex agent reacts with no memory. A model-based agent keeps enough state to notice a trend. A goal-based agent picks actions that reach a target. A utility-based agent scores its options and takes the best tradeoff. A learning agent checks its results and adjusts. Several working together make a multi-agent system.
The kind changing enterprise work is the agentic LLM: a language model with memory, a planner and tools attached. Developers build them with LangChain, Microsoft AutoGen, CrewAI and similar kits, and the Model Context Protocol is becoming the common way to hand an agent its tools.
Where they already work
IT help desks use them to read tickets and propose fixes. Support teams use them for returns and order tracking. Legal and finance teams point them at contracts to flag risky clauses. Retailers forecast demand and reorder with them. The common thread is a repetitive job with a lot of data and a clear next action.
Why security must live inside the loop
An agent inherits every permission of every tool it touches. When a chatbot gets something wrong, you get a bad sentence. When an agent gets something wrong, you get an action: customer data emailed to the wrong address, a record deleted, a token used where it should not be. A poisoned prompt does not stay in the conversation. It goes out through the tools.
That changes where the control has to sit. Filtering the prompt helps, and reading the logs afterward helps, but neither one stands between the decision and the action. After 25 years in enterprise security, I put the control where the action happens.
That is where Mountain Theory sits. It checks the action an agent is about to take against policy written in plain English, before it runs, and returns ALLOW, HOLD or BLOCK. Every decision is logged. The model still decides. The action does not run until it has been checked.
Takeaway
Agents earn their place by acting, and that is also the risk. Treat each action as a change to production, because it is one. Give each tool the least privilege it needs, keep sensitive data on infrastructure you control, and put the check on the action itself, before it runs, with a log you can hand to an auditor.