What are autonomous AI agents? An open-source test for the definition

Four definitions, one disagreement

An autonomous AI agent is a system that takes a goal, works through the steps to reach it in an environment it can act in, and begins that work with no person present to press go. Every vendor definition quoted below agrees on the acting. They split on the part that decides who can stop the run, and that split is architectural.

Microsoft, Salesforce, Snowflake and NVIDIA each publish a page that defines the term and then sells a product on the back of it. Read the five quotes side by side. The question they answer differently is the same one every time: what starts the agent, what it is allowed to touch while it runs, and where its work lands. Only one of them mentions a person.

Microsoft: independent decisions, and no named boundary

Microsoft's Copilot 101 page calls autonomous AI agents "systems that can independently analyze situations, make decisions, and act", systems that "don't just follow preset instructions" (Microsoft). The bar is independence from instructions. What the sentence leaves out is the boundary the acting happens inside. A reader cannot tell whether the agent acts on a file, a database or a customer's mailbox.

The Copilot Studio documentation adds the commercial half: autonomous agents are built in Copilot Studio, and billing runs on Copilot Credits at a varying number per action or response (Microsoft Learn). Neither page states what begins a run. On that definition a scheduler and a chat reply both count as autonomous.

Salesforce: the human as an escalation path

Salesforce's Agentforce page says "autonomous agents can execute on tasks and workflows independently", and it draws the line against "AI agents" that "are designed to work with a human involved" (Salesforce). This is the only one of the four that names a person, and it puts the person at the escalation: someone grants an authorization when one is needed, and otherwise the work continues.

What that leaves out is the start and the end. An agent that begins only when a colleague asks, and one that begins at 09:00 every weekday, are both "independent" here. One of them is a scheduler wearing a bigger word.

Snowflake: persistence, inside an envelope nobody states

Snowflake's page is the most specific about time. It says autonomous agents "are expected to stay engaged with an outcome", tracking progress and adapting over time rather than completing a single action and awaiting further instruction (Snowflake). Persistence is the property most definitions miss, and this one names it.

"Engaged with an outcome" still says nothing about the envelope it stays engaged inside. A run that tracks a support queue for a week inside a read-only copy of the ticketing system has one blast radius. The same run in the live queue, replying to customers, has another.

NVIDIA: controls at the infrastructure layer

NVIDIA's glossary describes AI agents as "advanced AI systems designed to autonomously reason, plan, and execute complex tasks based on high-level goals in a secure environment with controls" (NVIDIA). Of the four, this is the only definition that puts a control inside the sentence.

"With controls" is carrying a lot of weight in one preposition. The controls live in the environment, at the infrastructure layer, and the definition does not say who sets them, which actions they cover, or what happens to the output at the end of the run.

The three parts a definition needs to be checkable

Set the five quotes in a row and the disagreement collapses into three questions. Each one is answerable from a file in a repository, which is what separates a definition you can run from a sentence you can only repeat.

• What starts a run. A person, a schedule, a signed HTTP request, or an event in a connected app. Without this part, "autonomous" and "scheduled" are the same word.
• What the run may touch. Which tools it may call, which accounts it may reach, and what it may change. Without this part, "independent" describes an unbounded permission.
• Where the work lands. Whether the output appears in a chat window, in production, or as a change a person reviews. Without this part, autonomy is measured by how little anyone had to look at.

A definition with all three parts in it

Kortix publishes each part as configuration rather than as prose, so a reader can audit the claim line by line.

Start conditions are trigger types: "cron (a schedule slot arrives, or once at run_at), webhook (a signed POST reaches the trigger's URL), event (something happens in a connected app, such as a new pull request or a new email) and monitor (a command from your repository prints a line on stdout)." A cron expression takes six fields, second first, and a trigger fires at most once a minute. That manifest entry carries the sentence the whole comparison has been circling: "A trigger starts a session with no person present."

What the run may touch is a tool policy: "Rule each tool call allow, ask or block", with the rule able to reach the arguments a call was given. A person sets the policy, so the envelope is written down before the first run and can be read afterwards.

Where the work lands is the session and its branch: "A session runs one agent in its own sandbox. The sandbox clones the repo and works on a new branch." When the agent is done, "The agent commits, pushes the session branch, and opens a change request against the project's default branch. A person with the project.gitops.merge permission reviews the change request and merges it."

Run the four vendor definitions through those three questions and each one comes up short in a specific place. Microsoft leaves out the start and the boundary. Salesforce leaves out the start and the end. Snowflake leaves out the envelope. NVIDIA leaves out who sets the controls. Each is right about what autonomy feels like from the outside. None of them tells you what to inspect, which is why two products with opposite stop rules can quote the same paragraph.

Two follow-ups go further into the mechanism. Autonomous vs human in the loop separates an agent that runs unattended from one that waits at every step, and running an agent with nobody watching traces a session from its trigger to its change request. Autonomous agent examples shows the work agents hand back once all three parts are configured.