When the Tool Stops Waiting for a Prompt

Everything in this series so far assumed a human typed the request. That assumption is expiring, and it changes the academic conversation more than any tool before it.

The demonstration takes about ninety seconds. Someone points an AI agent at an online course, gives it a login and a single instruction, and walks away. The agent reads the syllabus, watches the lecture videos at whatever speed it likes, posts in the discussion forum, takes the quizzes, writes the papers, and submits everything on schedule for fifteen weeks without another word from the person who set it running. At the end there is a passing grade, a transcript entry, and a human who learned nothing.

That is not a thought experiment. It is a category of tool that exists now, and it is the reason this part of the series cannot close without a separate conversation about what happens when AI stops responding and starts acting.

The institutional question

Is the institution ready for AI that acts on its own, not just AI that answers?

The distinction matters more than it sounds. Generative AI, the thing most campus policy was written about, waits for a prompt, produces a response, and stops. Agentic AI is given a goal, then plans, executes, checks its own work, and iterates across systems until the goal is done, with no human in the loop unless someone designed one in. Most institutional thinking, including a good deal of what earlier issues in this series describe, quietly assumed the first kind. Leadership needs to understand the second kind as a different animal, because the questions it raises are different in kind, not degree.

What this looks like in practice

Start on the academic side, where the agent-that-takes-the-course sharpens a point the assessment issue made gently. Detection was already a losing game against generative AI. Against agents, it is close to hopeless, because there is no suspicious artifact to examine, only a normal-looking pattern of logins, submissions, and forum posts, all timestamped and plausible. Institutions will be tempted to respond with technical countermeasures: behavioral analysis, browser fingerprinting, prohibitions on automated access to the LMS. Some of that is worth doing as a floor. None of it is a strategy, because it puts the institution in an arms race against tools that improve monthly and against students who can simply run the agent on a different device.

The durable answer is the same one the assessment issue reached, now with the stakes fully visible: the institution has to watch understanding happen. An agent can complete a course. It cannot sit across from a faculty member and explain a decision it made in a project, or defend a thesis under questioning, or perform a clinical skill, or walk a peer through its own code. Every assessment that requires the student to be present and thinking, in person or synchronously online, is one an agent cannot take. Agentic AI does not create a new pedagogical problem so much as it removes the last excuse for not solving the old one. Online programs in particular, where an agent can do everything and appear everywhere, need to treat this as urgent rather than eventual.

Now turn to the operational side, where the same capability is a genuine opportunity and a genuine hazard at once. An agent that can move across the SIS, the CRM, and the ticketing system could resolve a transfer credit inquiry end to end, chase down a missing financial aid document, or reconcile a schedule conflict without a human touching each step. For institutions running on thin staffing, that is real capacity, and it is coming whether or not the campus is ready. The hazard is that an agent operating across systems is also an actor with credentials, and an actor that can make mistakes at scale, quickly, in places where a human would have paused.

Which is why the guardrails for agents are stricter than for the chatbot era, and specific. Scope: what exactly is the agent permitted to do, and what is it prohibited from touching, stated before it runs? Human override: can a person stop it, and does a person review its consequential actions before they take effect? Audit: is every action logged, so that when something goes wrong, and something will, the institution can reconstruct what happened and why? A sensible default is to treat every agentic deployment as high risk until proven otherwise, and to require answers to all three questions before any agent gets institutional credentials. That posture will feel slow to the people excited about the capacity. It is far faster than the incident review.

Accountability deserves its own sentence, because agents blur it in a new way. When an agent takes an action that harms a student, misroutes a record, or commits the institution to something it should not have, the answer to “who is responsible” cannot be “the agent.” Someone approved its scope, someone gave it credentials, someone chose not to require review. The governance stretch of this series spent nine issues establishing that responsible AI is a set of owned jobs. Agents are where that principle gets tested hardest, because the tool is so capable that it invites people to forget there is still a human behind it.

Finally, the posture question, which every campus will answer whether it chooses to or not. Embrace, pilot cautiously, restrict, or ban: each is a defensible position for a given institution at a given moment. The indefensible one is having no position, because agents are already arriving through the same doors as everything else in this series: inside platforms the institution already licenses, on students’ own devices, and through the enthusiasm of staff who have discovered what these tools can do for a workload. An institution with no stated posture has a posture. It is just being written by whoever moves first.

The Atlas connection

In Atlas, our AI operating map, agentic AI is not a domain. It is one of the three lenses, applied to every group on the map, and its question is the one this issue has been circling: what changes when AI stops responding and starts acting? It sits outside the six groups deliberately, because an agent is the stress test for all of them at once. In the Mission group — Educate — it makes the redesign of assessment and integrity non-negotiable rather than advisable. In the Capacity group — Run — it raises the ceiling on what operations and infrastructure can absorb, which is where this series is headed later. And its guardrails come straight from Foundation and Defense: decision rights from governance, scope from policy and acceptable use, logging from monitoring and evaluation, credentials from security and risk, and a named owner from all of them, with the volume turned up. Four issues into this part, the thread has been what honest intellectual work looks like with AI inside it. Agents are the case where, if the institution is not careful, the work happens and no human was inside it at all. Next issue, the series turns to the Offense group — Serve — and the student journey, starting with the support systems students actually have to navigate.

Questions worth putting on the agenda

Worth asking with academic leadership, IT, and whoever owns risk in the same room, since agents cut across all three.

• Does our leadership understand the difference between AI that responds and AI that acts, and have we said which one our policies were written for?
• For each online program: which assessments would an agent be unable to complete, and how many of those does the program actually use?
• Where could an agent create real operational capacity here, and what scope, override, and logging would we require before letting one run?
• If an agent with institutional credentials made a consequential mistake tomorrow, who is accountable, by name?
• What is our stated posture on agentic AI, and if we do not have one, who is currently setting it for us?

The bottom line

For two years the campus AI conversation has been about a tool that waits to be asked. The next one is about a tool that does not wait, and it will test whether the institution built real readiness or merely wrote policies for the previous machine.

An agent can take the course, chase the document, and close the ticket. What it cannot do is decide what the institution stands for. That was always the human job, and it just became the only one that cannot be delegated.