What Kind of AI Do You Actually Have? A Taxonomy of AI at Work
Three levels, two task shapes, six cells. One of them is where small businesses make their money. One of them is where they get hurt. Most owners cannot say which cell they are standing in.
Ask an owner what AI they use and you will hear product names. Ask what kind of AI they use and the room goes quiet. There are three kinds, and the difference is not the model or the vendor. The difference is who drives. Cross that with the shape of the task and you get a six-cell map. This entry is that map, spoken plainly: the cell where small businesses make their money, the cell where they get hurt, and the reason so much AI spend lands in the wrong one.
The first axis: who drives
Level 1 is assisted use: a person prompting a model in a chat window. The human drives every step and judges every output; the AI is leverage on one person's thinking. Its return is real but personal, and almost impossible to measure at the level of an operation, which is why so much of it already happens in the shadows: people quietly assisted at home, unassisted at work.
Level 2 is embedded AI: a model working as one component inside a larger system. The software watches for events, makes bounded decisions, acts, and escalates to a human when its confidence drops. Nobody prompts it. The event does. It runs at three in the morning without anyone thinking about it, and its risk is managed by architecture rather than by attention: validation layers, review paths, fallbacks. The production system this publication examined is the type specimen: thirty-three nodes of workflow, one of them a small AI model doing one narrow job inside a cage.
Level 3 is agentic AI in the full sense: a model that plans and operates tools itself, within a mandate a person gives it. A frontier model assembling a working system end to end. Software making continuous decisions over a live physical process, around the clock, with no chat window in sight. The mandate has edges, but inside them, the model drives.
A note on that word, because it is doing more work than the industry gives it credit for. Before agentic was a product category, it was psychology. Albert Bandura's agentic perspective describes what makes a person an agent: intentionality, forethought, acting on your own plans, reflecting on the results. When this publication calls a system agentic in the full sense, it is holding software near that bar on purpose, and the honest consequence runs in both directions: it takes real capability seriously, and it refuses the label everywhere else. Not everything sold as an agent is one. Most products wearing the badge are Level 2 systems with a marketing upgrade, and the distinction is not pedantry. You architect, price, and supervise the two levels completely differently.
The new desk agents, and why they feel like a fourth kind
This is the right place to answer the question every owner is about to ask, because the products forcing it are landing on every desk: systems like Claude Cowork, OpenAI's Codex, or Perplexity's Computer, which connect to your email, your files, your calendar, your apps, and do real multi-step work inside their own infrastructure. They feel like a category of their own. They are not, and seeing why sharpens the whole map.
Run the axis test: who drives? You hand the system a mandate, pull the numbers, cross-check the folder, draft the report. The model plans the route, decides which of your connected apps to touch and in what order, executes, and comes back. Inside that mandate, the model drives, and that is the Level 3 signature. What is different is the mandate's lifespan. These are session agents: the mandate is born when you delegate and dies when the task is done. The other Level 3 systems on this map are standing agents: a build that runs until it ships, a process watched around the clock. Same level, two lifespans, and the distinction matters because a session agent leaves nothing running when it stops. There is no system afterward. There was a performance.
One refinement before moving on, because you may have already spotted the seam: the sub-type belongs to the mandate, not to the product. Hand the same workspace a schedule, clean these folders every Friday, and that mandate no longer dies with a task. You have made it a standing agent: a small unattended system, running on the vendor's infrastructure, whose route is still the model's to choose each week. Set it and forget it, and two months later something is exercising judgment in your folders that nobody is watching. That is not a reason to avoid the feature. It is a reason to govern it as what it became, and the governance question is one sentence long: what does a wrong run cost, and would you notice?
Which is exactly what separates them from connecting the same apps through a workflow platform like n8n, Airtable, or Notion, and the difference is not the number of connections. It is who decides the route, and when. On a workflow platform, a human designs the graph once, at build time. The pipes are fixed. Run it a thousand times and the same path executes a thousand times, which is why it stays Level 2 no matter how many apps it touches: the judgment was exercised in the design, and the design is the asset. Notice that those three platforms could hardly be less alike, a dedicated orchestrator, a database, a workspace, and the test does not care. The category never belongs to the product. It belongs to who fixed the route. In a session agent, the model chooses the route at run time, every run, on infrastructure you cannot open, version, or audit. The judgment is exercised live, and nothing accumulates.
So use the test that fits in one sentence: run the same job twice, and watch the path. Same path both times: you own an architecture, Level 2. A path the model may choose differently tomorrow: you are renting architecture one session at a time, Level 3. Neither is wrong. They are different purchases. The session agent trades away determinism, auditability, and per-unit economics to give you zero build cost and run-time flexibility, which is a brilliant trade for one person's open-ended work: the researching, drafting, and cross-referencing that never repeats exactly. It is the wrong trade for a bounded pipeline running four hundred times a month, where you need the same path every time, the audit trail, and a cost per run that rounds to pennies. That work belongs in the ROI cell, in a pipe somebody built on purpose.
The sentence to keep is this one: connected is not automated. Wiring your operation's apps into an agentic workspace hands every employee a capable assistant, and that is worth real money. It does not hand the operation an automation, because nothing runs when nobody asks. Both purchases can be right. They live in different cells, and they should be priced, governed, and measured as what they are.
The second axis: the shape of the task
The second axis is not about the AI at all. It is about the work. A bounded task has a closed output space and narrow judgment: extract these five fields, classify into this fixed list, route by these rules. There is a right answer, and a machine can be checked against it. An open-ended task has an unbounded output space, and judgment is the product itself: research, drafting, ambiguous reasoning, design. There is no answer key, only better and worse, and someone has to be qualified to tell the difference.
The grid, spoken plainly
Three levels by two shapes: six cells. Every AI decision in your operation lives in one of them, and each cell has a verdict.
Assisted use on a bounded task is overkill by habit: asking a frontier chat model to reformat a list, paying conversation prices for clerical work. Common, harmless at small scale, and a signal that the task wants to be automated instead. Assisted use on an open-ended task is the natural fit: one person, one hard problem, real leverage. This is where chat interfaces earn their keep.
Embedded AI on a bounded task is the ROI cell. Economy-tier models inside a cage of checks, doing narrow jobs at high volume. This is where most of the measurable return in small business lives today, and it runs on the right-sizing rule: match the model to the task shape, not to the hype. The cell rewards boring architecture and punishes cannon purchases.
Embedded AI on an open-ended task is the danger cell. Unbounded judgment with no human gate: the system drafting customer-facing answers nobody reviews, approving what it cannot evaluate. The task shape demands judgment the architecture cannot verify, so a confident wrong answer flows straight into the operation. The verdict here is one word: escalate. The loop-sizing rule says why: where errors are cheap and reversible, review is theater, but where a wrong answer is expensive, irreversible, or customer-facing, the loop earns its cost. Refusing to build one is not efficiency. It is exposure.
Agentic AI on a bounded task is continuous local decision-making: systems watching a live process and steering it inside tight limits, day and night. It is the youngest cell on the map and the one this publication is studying in the field right now; it will get its own entry when the case is verified, not before. Agentic AI on an open-ended task is the cannon: frontier models building systems, collapsing weeks of build time into days. It works, and it has one non-negotiable requirement on the human side: the operator's knowing. The cannon does not collapse the knowing; someone must still be qualified to judge what got built.
The rules the map enforces
Lay the grid on the table and three working rules fall out of it. First, right-sizing: each cell has its own correct model class, so the question is never which model is best, it is which cell you are in. Second, loop-sizing: size the human loop the way you size the model, to the task and not to the fashion; the same operation can honestly run one pipeline fully automated and keep a person inside another. Third, the credibility rule: never claim a Level 2 system is a full agent. Builders see through it in minutes, researchers dismiss it on contact, and the clients who eventually learn the difference remember who taught them wrong.
And underneath all three, the human chain this publication keeps returning to runs through every level: assisted use fails on fear, embedded systems survive on architecture and rollout, and agentic systems survive on the operator's knowing. The taxonomy tells you what you are building. The chain tells you whether your people will be standing when it arrives.
Find your cell on a Monday
Take the one process that costs you the most attention and ask the two questions in order. Who drives, or who should: a person each time, the event, or a mandate? What shape is the task: is there a right answer a machine can be checked against, or is judgment the product? Two answers, one cell, and the cell tells you the model class, the loop, and the budget before any vendor gets a word in. That is the whole discipline: locate first, shop second. It is also, not coincidentally, the first thing we do with a client, before any tool is ever named.
If you want the even shorter version of that first decision, the Impact vs. Risk Matrix is the free one-page tool: where the impact is high and the risk is low, automate first.
Frequently asked questions
What is the difference between an AI assistant and an AI agent?
Who drives. With an assistant, a person prompts a model, judges the output, and drives every step; the human is the engine and the AI is leverage. With an agent, software acts without being prompted by a person: an embedded system reacts to events and makes bounded decisions inside guardrails, and an agentic system in the full sense plans and operates tools itself within a mandate. The word matters commercially because many products sold as agents are embedded systems with a marketing upgrade. The test is not the demo. The test is who initiates the work and who is exercising judgment while it runs.
What is embedded AI?
A model working as one component inside a larger automated system: software that watches for events, makes narrow, bounded decisions, acts on them, and escalates to a human when its confidence drops. Nobody prompts it; the event does. It runs around the clock, and its risk is managed by architecture, meaning validation layers, review paths, and fallbacks, rather than by a person supervising each step. For small and mid-sized operations, this is where most of the measurable return from AI lives today, typically with small, inexpensive models doing narrow jobs inside a cage of checks.
What is agentic AI?
In the full sense: a model that plans and operates tools itself within a mandate a human gives it, such as assembling a working system, running a multi-step build, or making continuous decisions over a live process. The word has a longer history than the tech industry that adopted it: in psychology, Albert Bandura's agentic perspective describes humans as agents through intentionality, forethought, self-reaction, and self-reflection. Holding software to a bar near that word is deliberate. Very few products sold as agentic clear it, and calling a bounded embedded system a full agent is the overclaim that burns credibility.
Are Claude Cowork, Codex, and similar agentic workspaces a new category of AI?
No. Run the who-drives test and they are Level 3, agentic AI: you hand over a mandate and the model plans the route, chooses which of your connected apps to touch, and executes inside the vendor's infrastructure. What is distinctive is the mandate's lifespan: they are session agents, whose mandate is born when you delegate and dies when the task completes, unlike standing agents that run a build to completion or watch a live process continuously. They also differ from connecting the same apps through a workflow platform like n8n, Airtable, or Notion, where a human fixes the route once at build time and the same path executes on every run. The practical test: run the same job twice and watch the path. A fixed path means you own an architecture; a model-chosen path means you are renting one per session. One refinement: the sub-type follows the mandate, not the product. Give the same workspace a recurring schedule, such as a weekly folder cleanup, and that mandate is standing now: a small unattended system whose governance question is what a wrong run costs and whether you would notice. And the line that follows for operations: connected is not automated.
Which type of AI gives the best return for a small business?
Embedded AI on bounded tasks, by a wide margin in what this publication has examined in production. Bounded tasks have a closed output space and narrow judgment: extract these fields, classify into this list, route by these rules. That shape lets an economy-tier model do the work inside an architecture that catches its errors, which keeps costs low and reliability defensible. The pattern to copy is not a bigger model; it is a narrower task with better guardrails. Frontier-model spend is justified at build time and for open-ended work, not for running a bounded pipeline.
When should AI not run without a human?
When the task is open-ended and the errors are expensive. An embedded system making unbounded judgment calls with no human gate is the most dangerous cell on the map: the task shape demands judgment the architecture cannot verify, so a confident wrong answer flows straight into the operation. The rule that falls out is to size the loop to the task: where errors are small, cheap, and reversible, full automation is honest and mandatory review is theater; where a wrong answer is expensive, irreversible, or customer-facing, escalation to a person earns its cost. Refusing that loop is not efficiency. It is exposure.
Sources
- Bandura, A. (2001). Social cognitive theory: An agentic perspective. Annual Review of Psychology, 52, 1–26. https://doi.org/10.1146/annurev.psych.52.1.1
- Bandura, A. (1997). Self-efficacy: The exercise of control. W. H. Freeman.
Published: July 12, 2026