What this is
A model that can retrieve is answering questions. A model that can act is doing things. Doing things has consequences that reading does not.
“It looked up the flight” means a list came back. “It booked the flight” means money moved, a seat is held, and undoing it is a customer-service problem, not a refresh.
An agent, in the useful sense, is the same model allowed to choose the next tool call for a while without a person in between each one.
Agency is the loop of selecting tool calls without a human in between each step.
Read tools keep the system in question-answering. Write tools enter side effects: payments, messages, records, physical scheduling. The utterances are similar; the liability is not.
Agent is not a second kind of model. It is a policy about how long the loop may run, and which tools it may call.
Easy to mix up
This is easy to mix up with one pile called “the AI can use my stuff.” Memory, retrieval, and action are three jobs. MCP, if it is in the picture, is only the plug on the action job. The plug does not decide read versus write. Someone has to.
A read-only demo is a limit on purpose. The failure that matters is a wrong action, not a wrong sentence.
Collapsing parametric knowledge, RAG, and tool use into a single “connected model” story makes policy impossible. Authorization belongs on each tool.
A read-only demo is a deliberate limit on agency, not a reduced version of the same product. Model quality still matters for which call gets proposed. It does not substitute for a write being denied.
From work
Travel asks an assistant for Tuesday flights to Denver under a cap. A look-up tool returns a list. That is a page of options. A booking tool, given the same chat, can issue a ticket. Same thread, two different objects: a list, then a confirmation number.
If it is not clear which tool ran, it is not clear whether a choice is still open.
Fare search is a read. Issuing a ticket is a write with payment and inventory effects. Confirmation numbers in the transcript are evidence a write landed.
Least privilege, human confirmation on irreversible calls, and an audit of which tool fired are the controls that matter. The companion page on how to read a demo is the same distinction for a room watching a screen.
What to ask next time
Did a list come back, or did a record change? Which tool names fired? Is there a confirm step on anything that spends money or sends mail?
Ask for the tool trace, read versus write on each call, and where confirmation sits. If the demo is one paragraph, the loop is not visible.