The Agentic AI Landscape
The Agentic AI Landscape
- Curiosity about how AI agents work. No prior Mandaitor knowledge required.
- place the main pieces of the agentic-AI ecosystem — models, frameworks, and protocols
- explain the gap between capability, authentication, and authorization
- describe where a neutral authority layer like Mandaitor fits, regardless of model or framework
Agentic AI is moving quickly, and the ecosystem can feel crowded: new models, new frameworks, new protocols, and a new acronym every week. This lesson is a map. Its goal is not to teach every tool, but to help you place the pieces so you can see where verifiable authority — the problem Mandaitor solves — belongs. If you are brand new, start here; if you already build with agents, use this to locate Mandaitor in a stack you already know.
What "agentic" means in one sentence
An agent is software that uses a model to pursue a goal by reasoning, choosing tools, and taking actions — not just producing text. The moment a model can call a tool, user intent can become real-world action. That is what makes agents useful, and it is also what makes authority a first-class concern.
For a European lens on why this matters commercially, Anthropic's talk on agentic AI in Europe's startup ecosystem covers where agents are already doing real work — and every example implies the same governance question this Academy answers: who authorized that action?
The three layers of the ecosystem
Most of what you read about agents lives in one of three layers. Keeping them separate makes the landscape far less confusing.
The reasoning engine
Foundation models from providers such as OpenAI, Anthropic, Google, and the open-model community. They plan and decide, but they do not enforce who is allowed to do what.
How agents call tools
Function/tool calling, the Model Context Protocol (MCP), and orchestration libraries connect a model to real tools and systems. They move intent toward action.
The missing layer
Before a sensitive action runs, someone must verify it is inside a granted, revocable mandate — independent of which model or framework proposed it. That is Mandaitor.
The gap: capability and authentication are not authorization
Model providers give an agent capability (it can reason and call tools). Your infrastructure usually gives it authentication (an API key proving which system is calling). Neither of those answers the question that matters at the moment of action:
Did a specific principal grant this specific delegate the right to perform this specific action on this specific resource, right now?
That is authorization, and it is where most agent stacks are thin. An API key says "this service may call the API." It does not say "this agent may issue a refund for this customer, up to this amount, until this date, with human review." That gap is exactly what agents make dangerous — and what a mandate makes safe.
Where Mandaitor fits: bring your own model and framework
Mandaitor is deliberately neutral. It does not replace your model provider or your agent framework — it sits at the tool-action boundary and answers the authorization question for whatever is calling. You keep OpenAI, Anthropic, an open model, MCP, or your own orchestration; Mandaitor governs what the agent is allowed to do and produces a signed proof you can keep.
| Ecosystem piece | What it provides | What it does not provide |
|---|---|---|
| Model provider (OpenAI, Anthropic, …) | Reasoning, planning, tool-call proposals | Per-action authorization for a specific principal |
| Function calling / MCP | A standard way to expose and invoke tools | A verifiable, revocable authority boundary |
| Orchestration framework | Multi-step agent control flow | Evidence that an action was permitted |
| Mandaitor | Runtime verification + signed proof of authority | The model or the tools themselves — you bring those |
Why is an API key not enough to authorize an agent's action?
- An API key authenticates which system is calling, but not whether a specific principal granted this delegate the right to perform this specific action on this resource.
- API keys are always insecure and should never be used.
- It is enough — if the agent has a key, every action it takes is authorized.
Reveal answer
Authentication ("who is calling") is different from authorization ("may this action happen for this principal, on this resource, under these constraints, right now"). Agents turn intent into action, so the authorization question must be answered per action — which is what a mandate check provides.
See it in action
The demo below runs the real @mandaitor/react mandate creator against an in-browser mock. It is the same authority object an agent's action is later checked against — no matter which model or framework produced that action.
Where to go next
Now that you can place the pieces, go one level deeper into what makes a system "agentic," then see how Mandaitor plugs into two specific stacks.
Save your learning progress
Mark this lesson as complete to update the Academy overview without requiring an account.