An Agent Acts. A Chatbot Answers. Do Not Give the Model the Till

A chatbot is software that produces text. An agent is software that takes actions: it books a slot, sends an invoice, writes a row, calls an API. Mixing the two is how a salon gives a model the right to cancel Friday and refund a card. The model is good at language. It is not a cashier, a lawyer, or a sysadmin unless you wrap it in a list of tools and a human on the rejects.

This summer that line stopped being academic. An agent in testing drove a real intrusion. Model labs paused training to wall agents off from the open internet. Exchanges started letting agents trade inside user-set limits. OWASP’s 2026 list treats excessive agency as a first-class risk. For a ten-person company the lesson is smaller: let the model draft. Do not let it hold the keys.

I already wrote how an LLM sits on a paid step - tickets, emails, PDFs - and how I stream a chatbot in Next.js. This piece is the missing line: when that step is allowed to act, and when it must stop and wait.

1. Three things people collapse into “we have AI”

Keep them separate on a contract. Mixing them is how a “chatbot project” silently becomes an agent with write access to production.

• Coworker with a chat tab: a person pastes into ChatGPT. Fine for drafts. Nothing in your CRM moved unless that person copied it.
• Chatbot in your product: a model answers on your site or in Telegram. It can retrieve your FAQs. It should not charge a card. I have written how to stream that in Next.js.
• Agent: the model picks a tool from a list you gave it - create invoice, book slot, post to the channel, refund. The damage radius is the tool list, not the prompt.

2. What a small business can bound this month

Start with read and draft. Keep write behind a button a human presses. That is not slow. That is how you sleep.

• Safe without a human in the loop: classify an inbound email, extract a name and a date, draft a reply in the owner’s tone, suggest three slots from a public calendar, answer from your own FAQ with retrieval.
• Needs a human confirm: create the booking, send the invoice, post to the public channel, change a price, grant access, talk to a payment provider.
• Never unsupervised, even with a “smart” model: refunds, deletes, bulk messages, moving money, signing contracts, running shell on a server that holds customer data.

3. The news this month, in one paragraph you can use

Labs are learning in public that an agent with a browser and credentials is a different threat than a chat box. That does not mean you freeze every AI project. It means your first version has an allowlist of tools, no open browsing on the box that holds Stripe keys, logs of every tool call, and a kill switch. MCP - the protocol that lets a model talk to tools - is plumbing. Shipping MCP on a server does not make the product safe. The product is safe when the tools cannot refund, and when a human still presses send on money.

4. How I would wire a bounded agent in Next.js

The frontend stays a chatbot until a tool needs a confirm. Then I show the proposed action - “create invoice 240€ for Anna, Friday 16:00” - and a person taps yes. The server holds the keys. The model never sees them. Tool results come back as data the UI can render, not as “the agent said it worked.”

• One adapter to the LLM provider. I wrote why that vendor is not the chat tab.
• Tools as typed functions on the server. No “just let the model write SQL.”
• Idempotency keys on anything that charges or books. Agents retry. Double charges are your problem, not the model’s.
• An audit log a non-engineer can read: who asked, which tool, which id, who confirmed.

Conclusion: rent language, keep the keys

An agent is useful when the tool list is short and money still waits for a person. A chatbot is useful when the job is language. If someone sold you “an AI employee that runs the shop,” they sold you a demo with production write access. I wire bounded agents into Next.js apps and Telegram bots: draft, extract, propose - confirm on the dangerous step. Write via the form with the action you want automated and the action you never want unsupervised. We will not start by handing the model the till.