Mechanically, close; in practice, no. Both use a model that can call tools. The difference is what happens next. A chatbot answers a person turn by turn and the person decides. An agent works toward a goal across many steps, acts in your systems and may finish before anyone looks. Once tools can write, the governance problem changes completely.
Why does the description sound right?
Because the architecture overlaps. Take a chatbot, give its model a list of functions it can call, and let it call them in a loop until it reaches an answer. That is roughly how an agent runner is built. The mechanics of tool calls are the same in both; see how an AI agent uses tools.
If the tools only read, such as looking up an order, the result is a better chatbot: it answers with live data rather than from memory. Little else changes.
Where does the description break down?
Three changes turn a chatbot with tools into an agent, and each brings a new obligation.
Tools that write. Once a tool can change a record, send a message or move money, a wrong choice by the model has an effect outside the conversation. Someone has to decide which writes are allowed, up to what limit, on what evidence.
Goals instead of turns. A chatbot responds to the last message. An agent pursues an outcome, choosing several steps on its own. Its route through those steps cannot be reviewed in advance, so each step has to be checked as it happens.
No person in between. In a chat, a person reads every answer. An agent may run from a queue, a schedule or another agent's request, with no one watching the individual steps. The person who used to be the control has gone.
What changes in governance?
| Concern | Chatbot with read-only tools | Agent with tools that act |
|---|---|---|
| Main risk | A wrong or leaked answer | A wrong action, possibly repeated |
| Who catches errors | The person reading | Controls outside the agent |
| What needs testing | Answer quality | Each capability, on real cases |
| Permission model | Which data it may read | Depth, limits, approvals |
| Record needed | Conversation logs | Every action's verdict and the bound that decided |
| Monitoring | Output quality | Whether it stays within bounds |
That last row is often missed. Monitoring an agent by sampling its outputs is not enough; you also need to test that its bounds hold, as argued in compliance monitoring of agents: test the bounds, not just the outputs.
What does this look like in practice?
Take a telecoms provider's support chatbot. It answers billing questions using a read-only tool that fetches the customer's latest bill. Errors are wrong explanations, which annoy customers and generate calls.
The provider then adds two tools: apply a goodwill credit and change the customer's plan. Now the same chatbot can alter what customers pay. A customer who says "the last agent promised me a credit of fifty" may get one. Plan changes may lock a customer into a contract term. The provider has, without quite deciding to, deployed an agent. It now needs a certified depth, a limit on credits, a rule that customer assertions about earlier promises are external claims to be checked, and a record of every credit and change.
The route from one to the other, done deliberately, is set out in how to move from a chatbot to a governed AI agent.
What does the platform layer have to do?
- Treat each writing tool as a capability with the depth it needs.
- Check every tool call at the moment of action.
- Keep facts' sources visible, so customer claims are not treated as verified.
- Leave actions above limits to a named person.
- File every verdict.
Tools themselves should reach systems through a controlled path; see how to put an API gateway in front of an AI agent's tools. The governing layer is described in the governed agentic operating system guide.
Questions people ask
Is a chatbot with read-only tools safe without governance?
Safer, not safe. Read-only tools can still expose data the chatbot should not show, so scope what each tool returns and log access.
Can a chatbot interface sit in front of an agent?
Yes. Many agents are reached through chat. The interface is not the issue; what the system can do without a person approving is.
When should we start treating our chatbot as an agent?
From the first tool that changes something outside the conversation. That is the point at which the person in the chat stops being a sufficient control.