The map: who decides, who acts, and how far the system goes on its own

The first series drew an agent platform, layer by layer. It never said when you need one. This series answers the question a business reader asks first: which kind of AI system does this job call for? The names on the slides will not tell you. Two questions will: who decides, and who acts. Eight families then fall into place, and the gaps between them show.

Why not the names on the slide

Five names come up in every deck: predictive AI, generative AI, RAG, AI agent, agentic AI. They do not belong to the same list. One is a model class (generative), one is a technique (retrieval-augmented generation), two are deployment patterns (agent, agentic), and the first is everything that was called machine learning until 2022. Sorting a job by which of those five it "is" tells you what the vendor sells. It does not tell you what the job needs.

Two questions do. Who decides: what produces the output that matters? A trained model emitting a score. A language model emitting text. A language model choosing the next action. An orchestrator splitting a goal between agents. Who acts: who turns that output into an effect on the world? A person. A business rule. The system itself, inside a perimeter. Several systems, across a process.

The law already sorts this way. The AI Act's definition of an AI system, Article 3(1), is a machine-based system "designed to operate with varying levels of autonomy" that "infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments". Four output types and an autonomy dial: that is the map, in one sentence, written in 2024. The word "agent" does not appear in Article 3 at all.

Add three axes and the picture becomes usable. Autonomy, from a system that informs to one that delegates. Reversibility of the worst action: reading, writing a record, or committing something that cannot be quietly undone, like moving money, sending a letter, revoking a benefit. Freshness of the data the system reasons from: a training run, an index, or the live system. And, to tie this series to the first one, the layer of the platform that carries the risk for each family.

Eight families

Two of the eight rows contain no language model. They run more of the world's AI than the other six combined, and they are the ones nobody calls AI at the budget meeting. Part 2 is theirs. The two content rows are where a person still reads everything before it leaves; the model writes, the human signs. The sources row is where the model reads what you own, and the risk becomes who was allowed to see which document. The three action rows are where the first series lives: the model, or a process around it, changes something in a system.

Three families from the usual lists are folded in rather than given a row. Small specialised models, fine-tuned for classification, extraction or routing, are a size choice, not a regime: they sit wherever the job they do sits, and they are often the right tool where a general model is used by reflex. Recommendation systems are the most deployed predictive case and share its row. Agentic RAG and graph RAG share the sources row, with one caveat the cell shows: once the model decides what to fetch, where and how many times, retrieval has become an action, and the governance changes with it. Part 4 takes that apart.

The autonomy scale, and why it is mine

There is no recognised standard for levels of autonomy in AI systems. The AI Act uses the phrase and does not grade it. So this series uses a working scale of five levels, borrowed in spirit from the way road vehicles are graded: SAE J3016 places a car at a level by asking who is driving, the person or the system, not by how good its sensors are. Same here. What places a system high is not the size of its model but who acts on the output.

The scale says nothing about model quality, and that is the point. A credit-scoring model from 2015, wired so that a score below a threshold refuses the application without anyone looking, is at level 4. A frontier model drafting emails that a person sends is at level 2. If your governance effort follows the model's sophistication, it is on the wrong row.

Reading the map: three lines that matter

The autonomy line is the one the regulator reads. Article 14(4) of the AI Act asks that the person overseeing a high-risk system can "decide, in any particular situation, not to use" it, "disregard, override or reverse the output", and "intervene in the operation … or interrupt the system through a 'stop' button or a similar procedure". Every one of those verbs assumes a system that acts, or a decision that stands, without the person. At level 1 they are trivially met: the person is the one deciding. At level 4 they need a surface that exists, and the first series found that surface missing in every open component it read. The same article, 14(4)(b), names "automation bias", the "tendency of automatically relying or over-relying on the output". That clause is written for level 2: the copilot whose proposals get accepted by habit. Swiss law adds a third marker, Article 21 FADP: a decision "based exclusively on automated processing" with legal or considerable effect gives the person a right to have it reviewed by a natural person. "Exclusively" is a line between level 1 and level 4, and nothing in it mentions a language model.

The reversibility line fixes where the approval goes. A read changes nothing. A write changes a record that can be changed back. A commit moves money, sends a letter, revokes a right; reversal is a new action with its own consequences. The approval a person gives belongs at the commit, not at the family: a generative system that publishes directly is a commit, an agent that only reads is not. The Model Context Protocol, the interface through which most agents reach their tools, states it as a principle: "hosts must obtain explicit user consent before invoking any tool", and adds that "MCP itself cannot enforce these security principles at the protocol level". Part 4 of the first series showed one way to enforce them per action; this series will only ask, for each family, which actions are commits.

The freshness line decides which failure you will see. A system reasoning from a training run fails by drift: the world moved, the model did not, and the failure is silent until someone measures it. A system reasoning from an index fails by confidence: it answers about last quarter's policy in the present tense, with a citation. A system reasoning from live data fails in the system itself, immediately, and the record of the failure is the record of the action. The monitoring the first series described in part 5 is a different job on each line.

Three jobs on the map

The same job can be placed on several rows. That is the most useful thing the map does, because the placement, not the technology, is what the law and the platform respond to. Three organisations, none of them real, each with a job that moves.

Read the table by column and the pattern is plain. The regulatory line depends on the job and its placement, not on the family: the same benefit assessment is high-risk at level 1 and at level 4, and the same predictive technique is high-risk for credit and unlisted for fraud. The platform column, on the other hand, depends almost entirely on the family. That split is the reason this series exists: the business reader can find their job in the first column and the lawyer's answer in the last; the platform reader can find the family and the layer it needs.

What the map does not say

It does not say which family is better. A level 1 model that has run a factory's maintenance for six years is not a lesser thing than an agent demo. It does not say what a family costs, in money or in people; the first series had a part on that and this one will not repeat it. It does not place any product: a vendor's "agent" is wherever its answers to the two questions put it, and the same product is often sold at one row and deployed at another. And it does not say that jobs stay put. The realistic path for an administration or a bank is not to replace a process with an agent but to let a model into one step of it, keep the engine in control, and move the step to an agent when the records show it is safe. That path is the augmented workflow row, and part 5 is about it.

One question carries into the next part. Two rows of the map contain no language model, run at level 1 most of the time, and can still reach level 4 with nobody noticing, because the wiring, not the model, moved them there. If a model that only emits a score can already sit where the oversight article bites, what exactly does the platform owe it? That is part 2.