Agentic AI versus generative AI

Generative AI and agentic AI often use the same language models, but they create different systems. Generation produces an artifact. Agency coordinates work toward an outcome.

The distinction changes architecture, testing, oversight and accountability. A generated draft can be reviewed before use. An agent may retrieve data, choose a tool, send a message, update a record and trigger another workflow before anyone sees the final output.

What is generative AI?

Generative AI produces new content from learned patterns and current input. The output may be text, code, images, audio, structured data or another representation.

The system boundary is often one request and response. Applications may add retrieval, templates, safety checks and human review, but the core job remains producing an artifact for a person or another program to use.

What is agentic AI?

Agentic AI is a software system that pursues a bounded goal through multiple steps. It may maintain state, select tools, gather information, revise a plan, ask for approval and create effects in external systems.

Agency is a property of the complete system, not the model. The architecture includes identity, task state, planning, policy, tools, memory, human authority, evidence and recovery.

How do the two approaches compare?

Dimension	Generative AI	Agentic AI
Core function	Produce content or predictions	Pursue a goal through actions
Interaction model	Prompt and response	Stateful workflow or delegated task
Tool use	Optional, often caller-selected	Common, often system-selected
Memory	Conversation or retrieval context	Task state, prior actions, durable workflow memory
Human oversight	Review output before use	Authority gates before consequential actions
Infrastructure	Model endpoint plus application	Orchestrator, policy, tools, queues, state and evidence
Primary risk	Inaccurate, harmful or exposed content	Cascading side effects, privilege misuse and loss of control
Audit need	Inputs, output, model and review	Full identity, policy, approval, tool and outcome chain
Evaluation	Output quality and safety	Task success, control behavior, recovery and outcome
Failure recovery	Regenerate or correct the artifact	Contain state, stop tools, reconcile side effects

Many products combine both. An agent may use generation to draft one step inside a governed workflow.

How does tool use change the risk?

Without tools, a poor answer may mislead a person or downstream application. With tools, the same error can become an email, permission change, purchase, deletion, deployment or data transfer.

The system should type each tool operation, apply least privilege, validate parameters, check policy immediately before execution, use idempotency where possible, record downstream receipts and verify final state for high-consequence actions.

Generic browser, shell or HTTP tools create broad authority. Constrain them through allowlisted operations, isolated environments, bounded credentials and explicit approval.

How does memory change the risk?

Generative systems may use recent conversation context or retrieval. Agentic systems often maintain durable state across steps or sessions.

Memory can improve continuity, but it can also preserve poisoned instructions, stale facts, sensitive data, or a mistaken assumption. Define what enters memory, provenance, scope, retention, access, correction and expiry. Treat memory changes as state-changing actions with evidence.

How should human oversight differ?

Reviewing the final answer is often enough for low-consequence generation. It is not enough when intermediate agent actions already changed the world.

Place approval before the consequence. Show the exact action, target, data scope, source, uncertainty and expected change. Bind approval to those parameters, make it expire and prevent reuse.

Low-risk actions can run under standing policy. Higher-consequence actions may require one or two authorized reviewers. Prohibited actions remain denied regardless of reviewer enthusiasm.

How does infrastructure differ?

A generative feature may require an application, model endpoint, prompt template, retrieval and content checks.

An agentic system adds:

• task and plan state;
• a typed tool registry;
• identity and delegation;
• contextual authorization;
• approval workflow;
• queues and idempotency;
• durable receipts;
• audit commitment and verification;
• incident containment;
• evaluation across complete workflows.

The extra components are not overhead added by governance. They are what makes multi-step action observable and controllable.

How should evaluation differ?

Generative evaluation often measures correctness, relevance, groundedness, safety and style. Agentic evaluation must also measure task completion, plan quality, tool selection, authorization, approval behavior, side effects, recovery and evidence.

Test complete scenarios with real interfaces or faithful doubles. Include negative paths:

• ambiguous goal;
• malicious retrieved content;
• unavailable model or tool;
• expired authorization;
• changed parameters after approval;
• duplicate request;
• partial completion;
• stale memory;
• cross-tenant target;
• audit failure.

A model benchmark cannot establish control behavior at an external system boundary.

How should audit requirements differ?

For generation, retain the request, relevant sources, model and prompt versions, output, safety decisions and human review as policy allows.

For agency, connect that information to task transitions, policy decisions, approvals, tool requests, downstream receipts and verified final state. Use ordered, tamper-evident records when the consequence and review need justify them.

The public audit-trail specification describes a reference profile and its limits.

Which approach belongs in which workflow?

Use generation when the job is to create, summarize, translate, classify or propose and a person or conventional application remains responsible for the next step.

Use agency when multi-step coordination has clear value, actions can be typed, authority can be bounded, tools can be controlled, failures can be recovered and evidence can be retained.

Do not add autonomy only to reduce clicks. The question is whether the system can carry responsibility for coordination without obscuring human authority.

How can a generative feature evolve safely toward agency?

1. Start with preparation only and no external side effects.
2. Add explicit task state and source provenance.
3. Introduce one typed, reversible tool.
4. Enforce per-action authorization.
5. Add parameter-bound human approval.
6. Record requests, decisions, receipts and outcomes.
7. Test interruption, duplicate and unavailable states.
8. Expand standing authority only after release evidence supports it.

This sequence keeps the action boundary visible. It also makes it possible to stop at the level that creates value without assuming full autonomy is the goal.

What should a buyer ask a vendor?

Ask the vendor to classify the product honestly. Which actions can it choose? Which tools can it call? What durable state can it change? What requires review? How are parameters bound? What happens when dependencies fail? Can you export and verify the record?

If the answer centers only on model quality, the product may be generative software described with agentic language. If it can act but cannot show authority and evidence, the system has agency without governance.

How does Trunnion use the distinction?

Trunnion's public position is agentic rather than merely generative: software organized around bounded workflows, model and tool orchestration, policy, human decision authority and execution evidence. Individual features may still use generation inside that system.

The exact autonomy, tools, models, controls and evidence vary by product and release. The distinction should be demonstrated in the workflow, not inferred from the label.