Copilots vs. Agents

What is the difference between a copilot and an agent?#

OpenAI's builder guidance defines agents as systems that use a model to control workflow execution, call tools to gather context and take action, and operate inside defined guardrails — explicitly excluding single-turn chatbots and classifiers, which do not control the workflow (OpenAI, A practical guide to building agents). Anthropic draws the same line between workflows, where the path through tools is fixed in code, and agents, where the model itself decides the path (Anthropic, Building effective agents).

For product decisions, a binary label is too coarse. Use an authority ladder:

"Copilot" normally covers the first three rungs. "Agent" normally begins at rung four, where the system executes through tools. The rung is context-specific rather than absolute: scheduling a meeting and moving money can run through the identical software loop while demanding entirely different authority.

Why does this matter to founders?#

The buyer changes. A copilot sells productivity to the person doing the work. An agent sells completed throughput to whoever owns the process and its service level. That moves the pitch from minutes saved toward queue depth, cycle time, exception rate, and who is accountable when it goes wrong — see Positioning.

The cost stack changes shape. Agents plan, call tools, inspect results, recover from errors, and carry state, so a single completed case can consume ten times the tokens of a copilot suggestion. The model call is rarely the expensive part; the reliable system around it — identity, permissions, logging, evaluation, guardrails, rollback, and a staffed exception queue — usually is. See Inference vs. Training Costs for how those layers stack.

Liability moves to you. The more the product can spend, publish, delete, approve, or modify, the more the contract has to say about authorisation, reversibility, auditability, and recourse. NIST's Center for AI Standards and Innovation showed why this is not theoretical: agent hijacking — indirect prompt injection that smuggles instructions into data the agent reads — succeeded far more often once attackers tailored attacks to the specific system (NIST CAISI, 2025).

Procurement expands. A copilot can enter through one team's budget. An agent with write access pulls in security, legal, IT, and the process owner. Budget for a longer cycle and a heavier contract.

How do you decide how much autonomy to ship?#

Run the proposal through three gates in order. Failing any one of them means the answer is a lower rung, not a better prompt.

1. Value gate#

Define the output operationally: which job is completed, how often it occurs, and what human minutes, delay, or leakage disappear.

gross task value = labour saved + delay avoided + incremental contribution − displaced human value

Do not count time saved if the user spends it checking the AI. If success cannot be observed without asking the model whether it succeeded, you do not yet have a measurable outcome.

2. Control gate#

Rank actions by exposure before you rank them by frequency:

risk exposure = action probability x impact x irreversibility x propagation

This is a prioritisation heuristic, not a calibrated loss model — the four terms are not independent and the product has no natural units. Use it to sort which permissions deserve investment, never as an expected-loss figure in a board pack.

For every tool permission, specify seven things: the allowed resource and action; a spend, quantity, or audience limit; the evidence required; the approval condition; the rollback path; an immutable audit record; and a named exception owner. NIST's AI Risk Management Framework is a workable scaffold for mapping, measuring, and managing these across the lifecycle (NIST AI RMF).

3. Economics gate#

For N completed cases:

net value = human time removed + incremental contribution
          − AI system cost − human oversight − expected failure cost − change-management cost

expected failure cost = Σ(probability of failure type i x impact of failure type i)

Compare four designs on the same workflow — human baseline, copilot with review, bounded agent with an exception queue, and full delegation — and pick the best risk-adjusted result. The winner is frequently rung three or four, not rung six.

Worked example: does the agent beat the copilot?#

An operations team resolves 20,000 invoice exceptions a month. Fully loaded analyst cost is $32 per hour. Model rates are Claude Sonnet 5 as published on 13 August 2026: $2 per million input tokens, $0.20 per million cache-read tokens, $10 per million output tokens.

Baseline. 12 minutes per case: $32 x 12 / 60 = $6.40 per case, or $128,000 per month.

Copilot. The model drafts a resolution; the analyst decides in 5 minutes.

model   = 6,000/1,000,000 x $2 + 800/1,000,000 x $10 = $0.012 + $0.008 = $0.020
tools   = $0.008
labour  = $32 x 5 / 60                                                 = $2.6667
per case                                                               = $2.6947

At 20,000 cases that is $53,893 of variable cost plus $8,000 of fixed platform cost: $61,893 per month, or $3.09 per case.

Bounded agent. The agent resolves 82% of cases end to end and escalates 18%. A run averages 40,000 input tokens (70% served from cache), 5,000 output tokens, 1.15 attempts per completed case, and $0.04 of tool calls.

input   = (12,000 x $2 + 28,000 x $0.20) / 1,000,000 = $0.024 + $0.0056 = $0.0296
output  = 5,000/1,000,000 x $10                                        = $0.0500
tools + guardrails                                                     = $0.0500
per run                                                                = $0.1296
x 1.15 attempts                                                        = $0.1490
escalation labour = 0.18 x ($32 x 9 / 60)                              = $0.8640
expected reversal = 0.82 x 0.2% x $40                                  = $0.0656
variable per case                                                      = $1.0786

The agent wins by $21,321 a month — but almost none of that comes from tokens. Model and tool cost is $0.15 of a $1.08 variable case; 80% of the agent's variable cost is the labour it failed to remove. Solve for the escalation rate at which the agent and the copilot cost the same:

20,000 x ($0.1490 + 4.80e + $0.08(1−e)) + $19,000 = $61,893
                                                e = 40.6%

Above roughly 41% escalation the agent is the more expensive product, even though it is the more impressive demo. That single number — not the rate card — is what belongs on the roadmap.

Caveat on this model. The reversal term assumes failures are independent and individually cheap. They are neither. One mis-scoped permission can produce thousands of correlated wrong actions in minutes, and no expected-value term captures that. Treat the table as a cost comparison for the ordinary case and handle the tail with hard limits.

What are the common mistakes?#

• Calling any LLM feature an agent. If the control flow is fixed in code, it is a workflow with a model inside it, and it should be costed and governed as one.
• Equating autonomy with value. A reliable recommendation the user trusts often beats a fragile end-to-end automation the user re-checks.
• Automating an unstable process. If the humans disagree about the policy, the agent cannot infer a durable target and every evaluation is contested.
• Granting broad permissions for convenience. Least privilege, narrow scopes, and explicit spend and audience caps cost one sprint and save one incident.
• Reporting attempts instead of completions. An agent that "handles" a case it later escalates has consumed cost twice — see Token Economics and Metering.

When does this framework break?#

When the loss is catastrophic or correlated. Expected-value arithmetic assumes many small independent outcomes. A credential leak, a mass send, a trade, or a destructive database command breaks that assumption. Those paths need hard technical limits and independent approval, sometimes no autonomous execution at all.

When success is subjective or lagged. In hiring, clinical, legal, or strategic work, a fast proxy metric rewards the wrong behaviour long before anyone notices. Keep the human decision-maker and design the system to surface evidence and uncertainty rather than a verdict.

When the security assumption is stale. NIST's red-teaming showed that a model robust against known attacks can be fragile against attacks written for it, and that repeated attempts materially raise attacker success. Defences validated once, against a public benchmark, are not a control.

Related concepts#

• Inference vs. Training Costs — model the extra inference, tool, and control cost that autonomy creates.
• AI Unit Economics and Gross Margins — carry cost per completed case into cost of revenue.
• Token Economics and Metering — instrument attempts, completions, and tool spend.
• AI-as-a-Service — package autonomy with service levels and exception handling.
• Managed Services — compare software autonomy with a human-backed delivery layer.
• Usage-Based Pricing — meter actions or completed work when seats stop tracking value.
• Product-Market Fit — prove the workflow and buyer before raising autonomy.
• Switching Costs — understand the dependence that write access creates.

Sources#

1. OpenAI, A practical guide to building agents, accessed 13 August 2026. Definition of an agent as a system that uses a model to control workflow execution within guardrails, and the exclusion of single-turn chatbots and classifiers.
2. Anthropic, Building effective agents, accessed 13 August 2026. The workflow-versus-agent distinction, and the argument for the simplest architecture that solves the task.
3. Center for AI Standards and Innovation (NIST), Technical Blog: Strengthening AI Agent Hijacking Evaluations, 17 January 2025, updated 19 December 2025. The 11%-to-81% adaptive-attack result, the 57%-to-80% multi-attempt result, and the case for task-level rather than aggregate risk reporting.
4. NIST, AI Risk Management Framework, accessed 13 August 2026. Lifecycle structure for governing, mapping, measuring, and managing AI risk.
5. Anthropic, Claude Platform pricing, accessed 13 August 2026. Claude Sonnet 5 input, cache-read, and output rates used in the worked example, and web-search tool pricing.
6. OpenAI, API pricing, accessed 13 August 2026. Web search and file search tool rates quoted in Key Facts.

Price-freshness note: Every rate on this page was checked against the provider's own documentation on 13 August 2026. Provider rate cards change on the provider's schedule, not yours — re-verify before using any figure in a board pack, a customer quote, or a pricing decision.