“AI” is often used as if it names one thing. It can mean the statistical model generating text, the chat product around that model, or a workflow that can read files and take actions. Those are different layers. If you separate them, product claims become easier to understand and permissions become easier to control.
AI is broader than generative AI
The OECD’s updated definition describes an AI system as a machine-based system that infers from inputs how to produce outputs—such as predictions, content, recommendations, or decisions—for explicit or implicit objectives. Those outputs can influence digital or physical environments, and systems vary in autonomy and in whether they adapt after deployment.
That definition covers more than chatbots. A fraud detector can predict whether a transaction looks suspicious. A recommendation system can rank songs. A vision system can identify an object. A route planner can recommend a path.
Generative AI is a part of this larger field. It produces new text, images, audio, video, code, or other synthetic content based on patterns learned from data. A system that classifies an email as spam uses AI, but it is not necessarily generative. A system that writes a reply is generative AI.
The useful distinction is about the output:
| System | Typical output |
|---|---|
| Classifier | A category, such as “spam” or “not spam” |
| Predictor | A probability or forecast |
| Recommender | A ranked list of options |
| Generative model | New text, media, code, or structured data |
| Decision or control system | A selected action that can affect an environment |
The model is the engine, not the whole product
An AI model is the learned computational component that maps inputs to outputs. In a language model, the input may include instructions and text; the output is a continuation assembled token by token. In an image model, text and images may be transformed into a new image.
Many current language products use Transformer-based models. Google Research’s original Transformer explanation describes self-attention: a way for the network to weigh relationships among parts of an input rather than processing every relationship only through a long sequential chain. That architecture became influential, but “Transformer” does not tell you a product’s data, training recipe, safety controls, tool access, or reliability.
A model by itself does not have your email password, calendar, files, or payment authority. The surrounding system may give it access to those things. That difference is central to safe use.
Training and inference happen at different times
Training is the process of adjusting a model’s parameters so its outputs improve according to a training objective. A language model may first learn broad patterns by predicting missing or next tokens across a large collection of material. Developers may then use additional training, examples, preferences, or other techniques to shape instruction-following and product behavior.
Training is not the same as saving your current conversation. Nor does it make the model a searchable copy of every document it encountered. Learned parameters encode patterns; they do not provide a dependable source trail for each generated sentence.
Inference is what happens when you use the trained model. Your prompt and available context are processed through the model to generate an output. Inference may also include several model calls, filters, retrieval steps, or tool calls, even when the interface shows one response.
This explains why a polished answer can still be wrong. The model is generating an output that fits the input and its learned behavior. Unless a separate process checks a claim, fluency is not verification. NIST’s Generative AI Profile identifies confabulation—confidently presented false or erroneous content—as a risk to manage.
An assistant is a product layer
An AI assistant combines a model with product choices. These may include:
- a chat or voice interface;
- system instructions and behavioral rules;
- conversation context;
- safety filters;
- account settings;
- access to search, code execution, files, or other tools;
- saved preferences or memory;
- logs and confirmation screens.
Assistants using the same model can behave differently because their instructions, tools, context, and policies differ; one assistant may also switch models by task. Judge the complete system. A current answer may come from search, a correct total from a calculator, and a failed action from an integration.
Tools turn words into access and action
A tool is an external capability the system can call. Search can retrieve current pages. A calculator can perform arithmetic. A file tool can read or edit a document. A calendar tool can create an event. An email tool can send a message.
Tools let the system observe current information or change something outside the chat. They also add failure points: wrong tool, wrong input, misunderstood result, or an uncompleted action reported as successful.
For any tool-enabled task, ask three separate questions:
- What did the model propose?
- What did the tool actually return or change?
- What evidence in the destination system confirms the final state?
“The assistant said it sent the email” is not the same as an item appearing in Sent with the correct recipients and attachment.
Memory is not one thing
Products use “memory” for several mechanisms:
- Current context: The instructions, messages, and documents available in this interaction.
- Saved preferences: Details stored by the product for later conversations.
- Retrieved records: Files, database rows, or notes fetched when needed.
- Model parameters: Patterns learned during training.
- Workflow state: A task list, previous tool result, or checkpoint used by an agent.
These mechanisms have different privacy implications. Removing a chat may not remove a saved preference, and disconnecting a file source may not erase text copied into a conversation. Model parameters are not a reliable personal filing cabinet.
Before enabling memory, find out what is stored, where it appears, how it is used, and how to delete it. Do not use the vague promise that a system “remembers” as evidence that it will accurately retrieve a specific fact.
An agent adds a goal-and-action loop
There is no single universal boundary between an advanced assistant and an agent. A practical definition is:
An agent is a system that can pursue a goal over multiple steps by selecting actions, using tools, observing results, and deciding what to do next with some delegated autonomy.
An assistant might draft a meeting invitation. An agentic workflow might inspect calendars, choose an available slot, create the event, notify participants, and retry if one service fails.
Agency is a spectrum, not a magic property. A workflow becomes more agentic as it can:
- plan more than one step;
- choose among tools;
- act without a prompt at every step;
- retain task state;
- react to tool results;
- run for longer or on a schedule.
More autonomy can reduce effort, but it also lets one mistake travel farther. NIST’s AI Risk Management Framework organizes risk work around Govern, Map, Measure, and Manage. For everyday use, that translates into a simple discipline: define responsibility, map the task and consequences, observe performance, and limit or change the system when evidence does not support more trust.
Use graduated trust, not blanket trust
Grant access in steps. Increase autonomy only after the system performs a bounded version of the task and you can inspect what happened.
| Level | Suitable delegation | Permission pattern |
|---|---|---|
| 0: Generate | Brainstorm, explain, rewrite public text | No connected accounts; review the output |
| 1: Read | Search public sources or read selected files | Read-only, narrow source scope |
| 2: Prepare | Draft an email, form, event, or edit | Create a preview; no sending or publishing |
| 3: Confirmed action | Send, publish, book, or modify | Ask before each consequential action |
| 4: Scoped automation | Repeat a tested, reversible workflow | Tight limits, logs, alerts, and stop controls |
| 5: High impact | Health, legal, financial, safety, employment decisions | Qualified human authority retains the decision |
Reversibility matters. Renaming a copy of a file is different from deleting the only version. Drafting a payment request is different from transferring money. Reading one folder is different from accessing an entire drive.
Practical exercise: classify before you connect
For each scenario, identify the model task, the product layer, any tool, and the highest permission required.
| Scenario | Classification | Sensible boundary |
|---|---|---|
| Summarize a pasted public memo | Assistant using a generative model | No external access; check the summary against the memo |
| Find today’s train schedule | Assistant plus a live search or transport-data tool | Read-only; confirm date, route, and operator |
| Compare selected private project files | Assistant plus file retrieval | Read-only access to one folder, not the whole drive |
| Draft an event after checking calendars | Agentic, multi-tool workflow | Preview the time, attendees, and description before creation |
| Send recurring invoice reminders | Scheduled agentic workflow | Approved template, named recipients, logs, and an easy pause control |
| Recommend a medication change | High-stakes generated advice | Do not delegate the decision; use a qualified clinician |
Now map one task of your own:
- Goal: What exact outcome do I want?
- Inputs: What information is genuinely necessary?
- Model output: Is it a draft, prediction, recommendation, or decision?
- Tools: What can the system read or change?
- Memory: What will remain after this session?
- Consequences: What happens if the output is wrong?
- Permission: What is the narrowest access that works?
- Confirmation: What must a person inspect before action?
If you cannot answer those questions, do not add more permissions yet.
The durable mental model
Think in layers:
Input → model → assistant rules and context → tools and memory → action → observable result
The model label tells you little about the full risk. A modest model with access to payroll can be more consequential than a highly capable model drafting a fictional story with no tools. Judge the whole system by its inputs, access, autonomy, evidence, and effects.
Then verify important factual outputs with the companion guide: How to Verify an AI Answer.