AI agent terminology is a mess. Vendors use assistant, copilot, background agent, autonomous agent, and workflow agent as though these labels describe distinct types. The two most important factors for categorizing agent types are:
- Does the agent work under supervision (attended) or without active supervision (unattended)?
- Is the agent working on behalf of an individual or an organization?
These two axes leave four kinds of agents in total. They determine how an agent should be owned, authorized, supervised, and secured. Terms such as autonomous, background, or multi-agent describe additional attributes rather than primary agent types.
Two axes describe how an agent works
The accountability axis asks whose work context governs the run:
- Individual: One person is the primary principal for the work. Their request, context, and authority constrain the agent.
- Organization: The agent performs a shared or standing role. An organizational owner defines its purpose, audience, and access.
The engagement axis asks whether a person actively participates during execution:
- Attended: A person remains in the current exchange and can direct, review, or approve work as it develops.
- Unattended: The run proceeds without requiring active participation. A request, schedule, event, queue, or system signal may start it.
Engagement →
Works with one person in an active session. The person directs or reviews the work as it develops.
Completes a bounded task for one person without requiring that person to remain in the session.
Performs an organizational role while employees or customers interact with it through a shared channel.
Performs a standing organizational job when a schedule, event, queue, or system signal starts a run.
Works with one person in an active session. The person directs or reviews the work as it develops.
Completes a bounded task for one person without requiring that person to remain in the session.
Performs an organizational role while employees or customers interact with it through a shared channel.
Performs a standing organizational job when a schedule, event, queue, or system signal starts a run.
Classify each run, because the same software can operate as more than one type. Product category, deployment location, and model architecture do not determine the answer.
What is an attended individual agent?
An attended individual agent, often called a personal assistant or copilot, works with one person in an active session. The person supplies context, steers the task, and can intervene before a consequential step.
Examples include an IDE agent editing code with a developer, a research assistant gathering sources during a live chat, and a document assistant revising a proposal with its author.
The agent normally uses access associated with that person’s session. Human presence improves oversight, but it does not make every action safe. Approval should still be explicit for actions that publish, spend, delete, disclose, or change shared systems.
What is an unattended individual agent?
An unattended individual agent, or delegated agent, completes a bounded task for one person without requiring that person to remain in the session. The requester delegates the work and returns to inspect the result.
Examples include a cloud coding agent preparing a proposed fix, a research agent compiling a briefing, and a personal agent monitoring a price or deadline. A trigger or schedule does not automatically make an agent organizational. The run remains individual when it acts on one person’s behalf under that person’s authority.
Delegation needs a clear end. Access should be scoped to the task, expire when practical, and remain attributable to the requester. A recurring personal task also needs a way to revoke the standing grant.
What is an attended organization agent?
An attended organization agent, or shared service agent, performs an organizational role while employees or customers interact with it through a shared channel. The person in the conversation requests work, while the organization owns the role and defines its powers.
Examples include an internal Slack agent that employees can mention, an IT service agent in Microsoft Teams, and a customer-support agent resolving requests in live chat.
This arrangement introduces two identities: the shared agent and the current requester. The agent must check both before acting. A person who can ask the agent a question should not automatically inherit every permission held by the agent’s service identity.
What is an unattended organization agent?
An unattended organization agent, or autonomous workflow agent, performs a standing job when a schedule, event, queue, or system signal starts a run. The organization owns the purpose, access policy, monitoring, and outcomes.
Examples include a nightly finance agent investigating discrepancies, an incident-response agent started by an alert, and a compliance agent reviewing new records as they arrive.
These agents can repeat an error quickly and at scale. They need explicit run limits, monitoring, escalation paths, and a named owner who periodically confirms that the purpose and access remain valid.
Terminology
Current terminology mixes product positioning, runtime mechanics, architecture, and security. Assistant sounds helpful, background describes execution, and autonomous describes discretion. None identifies both who the agent works for and whether a person stays involved.
Use individual and organization to name who is accountable for the work. Use attended and unattended, established automation terms, to name whether active human participation is required during execution. These four combinations should be the primary agent types. Treat the following terms as additional attributes:
- Assistant and copilot usually frame an agent as helping a person. They often map to attended individual agents, but they do not define permissions or execution mode. Agent is the broader capability term.
- Interactive, conversational, synchronous, coactive, and mixed-initiative often indicate attended work. Direct manipulation describes an interface style. A human approval gate can also appear inside an otherwise unattended run, so human-in-the-loop is an oversight control rather than a permanent type.
- Autonomous describes the degree of independent decision-making. All four arrangements can include autonomous actions. Automated means software performs a step or workflow, with or without AI.
- Background, asynchronous, cloud, and long-running describe where or how execution happens. A background run can stream updates immediately, so these terms do not prove that a run is unattended.
- Delegated, on behalf of, and offline access describe authority retained from a person or resource owner. Delegated authority can be used in attended or unattended work.
- Scheduled, event-driven, triggered, workflow, and system-initiated commonly describe unattended work. They do not prove organizational authority because a schedule can still run with one person’s delegated credentials.
- Personal, shared, service, workload, and enterprise describe audience, identity, or deployment. Multi-agent, subagent, and orchestrator describe architecture. Neither group determines a cell by itself.
- Reflex, goal-based, utility-based, and learning describe how an agent selects actions or improves. They are separate from accountability and engagement.
Identity and authorization follow the working arrangement
The four types establish operating accountability. Security implementation must also distinguish delegated-user authority, service or workload authority, and a hybrid that uses both across different steps.
OAuth captures the core distinction: A client can act on behalf of a resource owner or on its own behalf. In practical terms:
- An individual run usually uses a person’s delegated authority, constrained to the session or task.
- An organization run usually uses a dedicated service or workload identity with a narrowly defined role.
- A hybrid run may use both. Record and authorize the principal used for each consequential action.
Do not infer authority from the channel, trigger, or product name. A shared Slack agent can act with a bot identity or delegated user access. A scheduled agent can retain its maker’s credentials. For each consequential action, record the principal, effective scope, requester or trigger, approval, and outcome.
Task-scoped credentials limit a delegated agent to the assigned resources, actions, and duration. Agent composite identity preserves both the requester and acting agent in authorization and audit records. Services must enforce those limits outside the model for every tool call.
What are the main security risks for each agent type?
The working arrangement determines how an agent mistake becomes an incident. The same prompt injection has a different blast radius when it affects one reviewed draft, a delegated task, a shared service identity, or a recurring workflow.
Engagement →
It can take an unwanted action with the person's access before the person reviews it.
It can exceed the assigned task or retain the requester's authority after the task ends.
A requester can induce it to misuse standing organizational access that the requester does not have.
A faulty decision can repeat across runs, while unused access can persist after the job changes.
It can take an unwanted action with the person's access before the person reviews it.
It can exceed the assigned task or retain the requester's authority after the task ends.
A requester can induce it to misuse standing organizational access that the requester does not have.
A faulty decision can repeat across runs, while unused access can persist after the job changes.
These are the primary risks, not the only risks. Every arrangement still needs constrained tools, untrusted-input handling, output validation, logging, and incident response. OWASP describes excessive agency as the damage that unnecessary functionality, permissions, or autonomy can enable.
For a hybrid agent, apply the relevant control at each step. A shared agent that reads with service authority and writes on a user’s behalf needs both confused-deputy protection and task-scoped delegation.
Offboarding follows both axes
Agent access becomes stale when a person leaves, a task ends, a service owner changes, or a workflow is retired. Offboarding should follow the working arrangement:
- Attended individual: End the session and remove temporary grants.
- Unattended individual: Cancel outstanding tasks and recurring runs, then revoke retained delegation.
- Attended organization: Remove the agent from shared channels and disable its service identity or role.
- Unattended organization: Stop triggers and queues, revoke workload credentials, and transfer or close operational ownership.
Preserve audit records and verify that downstream systems reject the old identity. Previously issued credentials may remain valid until they expire or the service checks for revocation.
Build access control around the agent’s real job
The matrix should change implementation decisions. Accountability identifies who owns the work and which authority should apply. Engagement identifies whether correction can happen during the exchange or must come from limits, monitoring, and later review.
An agent inventory should record each agent’s owner, purpose, identities, access, and supported working arrangements. The Speakeasy AI Control Plane integrates with identity providers and scopes access by team and role. The MCP gateway provides tool-level access controls and audit records for calls routed through it.
Start with a specific deployment and the work it is meant to do. Identify the accountable person or organization, establish whether each run is attended or unattended, and approve only the access that arrangement requires. Talk to us about applying those controls to your agents.