What is an AI agent? An explanation with examples from logistics

What is an AI agent?

An AI agent is a system in which a language model decides for itself which steps a task needs, and carries out those steps by calling other systems. The language model (a large language model, or LLM) is the part that reads and writes text. The agent is everything around it: the model, the systems it can reach and the agreements about what it may do there.

Anthropic, the company behind the Claude language model, draws a distinction here. In a workflow the order of the steps is fixed in code and the model only fills in each step. In an agent the model picks the next step itself, and the system it uses for it. Anthropic calls both agentic systems.

A workflow does the same thing every time. An agent can leave the path when the situation calls for it. That is where its use lies, and it is also why it needs limits.

What is the difference between an AI agent, RPA and a chatbot?

Rules and RPA follow a fixed path and a chatbot answers in a conversation. An AI agent chooses its own steps and carries them out in your systems.

Rules and RPA

Classic automation works with rules. If the mail comes from this client and the attachment has this name, put column B in the item number field. RPA (robotic process automation) does the same by clicking on the screen the way an employee would. That works well as long as the input looks the same every time. If a client sends a new Excel template, the robot gets stuck and the order waits until someone updates the rule.

A chatbot or AI assistant

A chatbot or AI assistant answers questions in a conversation. You type something and it writes something back. It can summarise a long mail or draft a reply to a client. In your WMS it does nothing by itself. You copy the answer and you take the step.

An AI agent

An agent reads messy input the way a language model can, and then calls systems itself. It might look up an item or create a draft order. Here the system acts by itself. That is a different risk from a system that only returns text.

What does an AI agent in logistics look like?

An AI agent in logistics usually does administrative work around the floor, such as order processing from email and invoice checking.

An agent that processes an order mail

A client mails an order early in the morning, half in the body of the mail and half in a PDF. The agent reads both and recognises the items, also when the client uses its own descriptions. It looks up the item codes in the WMS and checks the available stock line by line. If everything is there, it prepares a draft order. If stock is short or it does not recognise an item, the order goes to a queue with a short note on what is missing. How such an order flow works is in orders from mail into your WMS.

Invoice checking, line by line

A carrier or staffing agency sends an invoice with dozens of lines. The agent reads each line and finds the source next to it: the shipment in the TMS, the clocked hours or the rate from the agreement. It decides per line which source it needs. For a night allowance it looks at the time of the shift, for waiting time at the arrival at the loading address. Lines that match, it marks. Lines that differ go on a list with the difference next to them. Someone in accounts payable does the paying. How that works for agency invoices is in checking staffing agency invoices.

Which limits does an AI agent in a business process need?

An agent in a business process needs four limits: which systems it may read and write, where a person approves, a log of every action and a fallback for when it cannot work something out. The OWASP Foundation, which maps the security risks of software, names too much functionality, too many permissions and too much autonomy as the usual causes when such a system does something harmful. The four limits keep those three small.

What may the agent read and what may it write?

You give an agent its own account in each system, with as few permissions as the work allows. The order agent may read items and stock in the WMS and create draft orders. It may not release orders or change stock. You set that in the permissions of that account in the WMS itself. A line in the instructions to the model stops nothing on its own.

Where does a person approve?

Every step that costs money or is hard to undo goes past a person. Think of releasing an order to the floor, paying an invoice or sending a mail to a client. The agent prepares and the employee decides, with the agent’s reasoning next to it. At first someone approves everything. Only when the measurements show that a type of decision is right every time do you let that type through without approval.

Is every action recorded?

Yes, and you agree that beforehand. Everything the agent reads, looks up or creates goes into a log: what it did, with which data, at what moment and on what grounds. If a client calls about a wrong delivery, you can see whether the mistake was in the mail, with the agent or with the employee who approved it.

What happens when the agent cannot work it out?

It hands the work back through a fixed fallback. The order or invoice goes to a queue with a note on where it got stuck, and the process carries on the way it ran without an agent. If the language model is down for an hour, your office carries on by hand. The WMS stays the system where the work happens.

What goes wrong with an AI agent and how do you prevent it?

Three things mainly go wrong: the model makes up something that is not in the source, it calls a system with the wrong data, or it follows a command hidden in a mail or document. A builder never rules that out completely, but can catch it before it does damage.

The model makes something up

A language model writes down what is likely. If an item number is half legible in a scanned PDF, it may fill in a number that looks just like it. That is called hallucination. So you check every value the model takes from a document against a system that does know the answer. An item code has to exist in the WMS and a shipment number in the TMS. If the agent finds no match, that is a reason for the queue. It may not fill the gap itself.

A wrong call

An agent can call the right system with the wrong values, or pick a function that does not fit the task. Think of a quantity with one zero too many, or an order under the wrong client. You catch that with fixed checks in code, outside the model. Such a check looks at whether a quantity falls within this client’s normal range and whether the item belongs to them. On top of that, the agent only sees the functions it needs for this task.

An instruction hidden in a mail

Anything the agent reads can try to steer it. If a mail or a PDF contains a sentence written as a command, a model may act on it. OWASP names this prompt injection as one of the causes of an agent doing something nobody wanted. Here too, limited permissions and the approval step help more than a cleverer prompt.

Do you need an agent or is a fixed workflow enough?

Often a fixed workflow is enough, and then it is also better. Anthropic itself advises choosing the simplest solution and only building something more complex when that turns out to be needed. If the orders from three clients always arrive in the same Excel format, a fixed integration will do. An agent pays off where the input differs every time and an employee now has to think about the next step for every order.

That is why we start with one process and a baseline measurement of how it runs today. Only when that first step demonstrably works does the agent get more room or does a next process come in, as our way of working describes. Whether such a system falls under the EU AI Act is in the AI Act in logistics. The same approach works for client questions about their shipments, see automating client questions.

Three questions for whoever builds your agent

Put these questions to every supplier that wants to place an agent in your WMS or ERP.

1. Which account does the agent use in each system, and what may that account do? If it can release orders or change stock, it is too broad.
2. Which steps go past a person, and who decides when that is no longer needed?
3. Where is the log kept, and what happens to an order when the language model is down?

Start with work you can check afterwards, such as an order mail that lands in the WMS as a draft and that someone still releases.