# What is an agentic AI platform?

An agentic AI platform runs AI agents that act on the business systems a company already uses and governs what they may do. Eight questions to ask of any platform, and where Liyagent answers each.

A chatbot answers. An **AI agent** acts: it reads a ticket, looks the customer up in Salesforce, drafts the reply, updates the record and closes the case. "Agentic AI" is that shift from answering to doing, usually across several steps and several systems, with the model deciding what to do next.

That is also why an agent needs more than a model and a prompt. The moment software can change records, spend money or send messages, someone has to decide who it acts as, which of its actions need a person's approval, what it may spend, what must never leave the building and how to prove afterwards what it did. The **platform** is the part that answers those questions for every agent, built-in or custom, in one place.

## The eight questions

Ask these of any agentic AI platform, Liyagent included. Each row names the control and where it lives here.

| Question | Why it matters | In Liyagent |
| --- | --- | --- |
| **Who is the agent acting as?** | An agent with a shared service account sees everything. An agent acting as the person asking sees only what that person may. | Each person connects their own accounts, and agents act with that person's permissions. [Connections](/docs/connect/connections), [identity and roles](/docs/govern/identity-roles) |
| **Which actions need a person?** | Reads are cheap to get wrong, but writes are not. The default should be "ask", loosened deliberately, per tool. | Writes on new connections wait for approval by default. [Cedar policies](/docs/govern/permissions) decide the rest, per agent, tool and person. |
| **What may it spend?** | Model cost grows with use. A runaway loop should hit a ceiling, not a credit card. | [Budgets](/docs/ai-gateway/budgets) per agent and team, with the kill switch behind them. |
| **What stops prompt injection and leaks?** | Agents read untrusted text: tickets, emails, web pages. Some of it is written to steer them. | [Guardrails](/docs/ai-gateway/guardrails) for prompt injection, personal data and denied topics, and [redaction](/docs/govern/redaction) before text reaches a model. |
| **Can you prove what happened?** | "The AI did it" is not an answer an auditor accepts. | A hash-chained [audit log](/docs/monitor/audit-log) of every call and decision, with signed exports anyone can verify. |
| **Where does the data live, and which model?** | Some data may not leave your network, and some teams may not use a particular vendor. | Self-hosted on a [VM, Docker or Kubernetes](/docs/get-started/deploy-vm), with [any model](/docs/ai-gateway/providers): Anthropic, OpenAI, Gemini, Bedrock, or open models through Ollama, vLLM and others. |
| **How does it reach your systems?** | An agent is only as useful as the systems it can act in. | Ready-made connectors for 50 systems, and any other over [MCP](/docs/connect/mcp-servers), OpenAPI, OData, SQL or A2A. [All connections](/docs/connect) |
| **Is it tested before it ships?** | An agent that passed a demo has not passed anything. | [Playground evals](/docs/agents/playground-evals) replay real cases against a change, and a red-team run can gate an agent's release. |

## What "self-hosted" changes

Most agentic AI products are a service: your tickets, records and prompts go to the vendor, and the model is the vendor's. Liyagent runs where you put it, with the model you choose, so the questions above have answers you control rather than answers you are given. See [Self-hosted AI agents](/docs/overview/self-hosted-ai-agents) for what that looks like in practice.

## See it act

[Try it live](/try): ask Liya to look up and change records in a sample CRM, approve or reject its changes, then read the audit trail it left. No sign-up.

*SAP, Salesforce, Microsoft and other product names are trademarks of their owners. Liyagent is independent of them.*