The types of AI agent, from writing its own skills to a fixed prompt

Sort them by freedom and the picture is simple: what the agent may change about itself, and what it may reach outside itself.

At the loose end sits the agent you give a machine, a key and a job, plus permission to write its own skills as it works; Hermes runs this way by default and its documentation describes skills the agent can create, update and delete (skills). At the fixed end is a path somebody reviewed in advance: the steps are code, the variable part is the value you were given a slot for, and nothing else can be reached. Most agents worth running live between the two, and the traffic is mostly one way. The loose end is where the work gets found; the fixed end is where it gets trusted.

The older answer is still the first one search returns: simple reflex, model-based reflex, goal-based, utility-based, learning. Those five describe software agents built before language models, and IBM lists them with no date and nothing to check (IBM). Databricks puts the problem plainly: depending on the source there are four types of agents, or five, or seven, often reflecting trends rather than durable design principles (Databricks). Neither list answers the question you have before you run one, which is what you have to hand over.

A workflow follows the path your code chose in advance; an agent chooses the path as it goes. Every platform draws the same line, and where an agent sits on it decides how much it needs to be given.

• Anthropic: workflows are models and tools orchestrated through predefined code paths, while agents dynamically direct their own processes and tool usage (Building effective agents).
• OpenAI: an agent is a system that independently accomplishes tasks on your behalf, and if the model does not manage the workflow execution and make decisions, it is not one (the practical guide).
• Microsoft: in a deterministic workflow your code controls the execution path and the model is called as a step inside it, while in an agent loop the path is not predefined (agent patterns).
• AWS describes the same gradient, from static workflows defined at design time to dynamic graph orchestration where the agent's reasoning chooses the next step, and Google Cloud splits it by predictability (Agentic AI Lens, design patterns).

Read that definition at the source. Anthropic's post is the most repeated sentence in this field, and it now carries an editor's note that much of the tooling landscape it describes has changed since December 2024 (the post). The distinction held. The examples dated.

There are five published ladders and no agreed standard. Each was written for a different reader — engineering, governance or investment — and they disagree about where the rungs sit.

Two things the ladders agree on. The bottom rung is always the person choosing the tool and the step. And as the agent climbs, the human stops being the safety mechanism: at the lower levels safety comes primarily from keeping a person in the loop, and as autonomy increases it has to move into the agent's policies, its operating environment and the institutions around it (MIT).

Three cautions before you cite any of them. The driving-automation ladder they borrow from is a proprietary standard, so every nought-to-five claim about agents is an analogy rather than a copy (SAE J3016). The Cloud Security Alliance document is stamped unofficial AI-assisted research that has not been through the organisation's review. And Bessemer's autonomy scale is an investor's framework from April 2025, which predates the current MCP specification (the scale).

It can build the procedure nobody had written yet, and write that procedure down as it goes. That is the whole case for the loose end: the work you can hand over is the work you could not have specified in advance.

• Hermes: the agent can create, update and delete its own skills, which its documentation calls its procedural memory, and it manages its own memory notes with the same tool. By default it writes skills freely, including from a self-improvement review that runs after a turn; a write-approval gate can require your approval instead (skills, memory).
• Claude Code: subagents run with their own context window, tool list and permissions, hooks are shell commands that always run rather than waiting for the model to choose them, and auto memory is notes the agent writes itself from your corrections (subagents, hooks, memory).
• Codex CLI: sandbox modes are read-only, workspace-write and danger-full-access, with approvals on request, on failure or never; by default the network is off and the sandbox is enforced by the operating system (approvals and sandbox, reference).
• OpenClaw: skills are SKILL.md files, sandboxing is off by default, and a skill workshop exists to review and approve the skill files the agent drafted (skills, sandboxing).
• AutoGPT, the 2023 original, is now a builder where you connect blocks and inspect each step: the same idea with the autonomy made visible (repository).

Three things make the loose end more than a demo. The procedure is a file: skills follow an open standard, a directory with a SKILL.md holding a name, a description and the steps, so what one agent worked out can be read, reviewed and reused by another (the specification). The tools are a protocol: MCP connects an application to outside systems, and its registry hands clients a list of servers (MCP, the registry). And the schedule is yours: Hermes runs jobs in fresh sessions, including a mode that delivers a script's output and never calls a model (cron).

What you get is a list of merits rather than a feeling: an agent that attempts what you could not describe, a written procedure you can keep and edit, and a way to try a new model without rebuilding the wiring.

In a fixed agent the path was chosen before the run, the tools are few and named, and the only thing that varies is what you put in the slot you were given. It is the shape you ship when a decision has to come out the same way next Tuesday.

The merits at this end are specific rather than spiritual.

• The same input gives the same decision, and the reason is stated by the platform that offers both shapes: compliance or auditability requires reviewable control flow (Microsoft).
• Every step can be a row in a record. High-risk systems under the EU AI Act must keep logs over their lifetime and be built so a person can intervene or stop them (Article 12, Article 14).
• The reach is bounded per agent and per session: credentials a workload retrieves are scoped to the identity in its access token, and a new agent identity starts with its own logging, models, sessions and sandboxes and nothing else (AgentCore, Vertex AI).
• There is a release gate rather than an opinion: evaluations set acceptance thresholds, such as an 85% task-adherence pass rate, before an agent goes in front of users (Azure AI Foundry).
• A change is a reviewable change. Entra's own reason for a separate identity type for agents is that a service principal offers no enforced sponsorship and no agent-aware audit entries (key concepts).

The cost of this end is the case nobody wrote down. Microsoft's architecture guidance is to use the lowest level of complexity that reliably meets the requirement (design patterns), which is the right rule for a process that already works and the wrong one for a process you are still finding out. How to narrow an agent walks the move from one end to the other.