The AI applications your buyers are procuring sit on a spectrum that runs from a single prompt to a fully autonomous agent. The rungs are real, they are distinct, and the most common mistake in AI procurement is treating them as interchangeable.
That's the orientation this section provides. Your buyers have already decided AI matters, which is why they're spending money on it. A way to place any AI initiative on the spectrum and ask the right next question before the contract is signed — that's what they need, and what you need to give them.
The Vocabulary Problem
Every maturing technology category goes through the same phase: the vocabulary gets ahead of the implementations. "Cloud" once described everything from a managed data center to a true serverless function, and vendors let buyers stay confused because the confusion was commercially convenient. "Zero trust" followed the same arc — by the time it appeared in every vendor deck, it had stopped meaning anything specific enough to be useful.
AI is in that phase now. "We're building an AI solution" is a sentence that currently covers a bare API call to a foundation model and a fully autonomous system that browses the web, writes code, and executes transactions. These are not the same thing. They don't cost the same to build, they don't require the same infrastructure to run, they don't carry the same governance surface, and they don't fail in the same ways. Treating them as interchangeable at the procurement stage is how agencies end up with the wrong architecture locked into a five-year contract.
The spectrum is the antidote to vocabulary drift. A shared coordinate system for you and your buyer.
The Four Rungs
The spectrum has four meaningful levels. Each gets its own treatment later in this section; what follows is the map.
Direct inference is the floor. A user sends a prompt to a model; the model responds using only what it learned during training. No external data, no tools, no memory between sessions. The model is a very sophisticated lookup — fast, capable within its training, and completely blind to anything that happened after its knowledge cutoff or anything that lives in your buyer's systems.
Retrieval-augmented generation adds a data layer. Before the model responds, relevant documents or records are fetched from an external source and injected into the prompt. The model reasons over that retrieved content. It still doesn't learn from the interaction, and it still can't take actions, but it can now answer questions about your buyer's internal data without that data ever being baked into the model itself.
Predefined workflows add structure and sequencing. A series of steps, some AI and some conventional software, is defined in advance. The AI operates inside that structure: it might draft a document, then a classifier routes it, then a human reviews it, then an API posts it. The sequence is fixed. The AI fills its assigned role in the pipeline; it doesn't decide what the pipeline looks like.
Autonomous agents remove the fixed sequence. The model decides what steps to take, what tools to call, and what data to access in pursuit of a goal. The path isn't predefined — the agent determines it in real time, based on what it finds along the way. This is where the capability ceiling rises sharply, and where the governance requirements rise with it.
What Changes as You Climb
The variable that distinguishes each rung is autonomy: specifically, how much of the decision-making about what to do next the system makes on its own, versus how much a human or a predefined rule makes for it.
At the bottom of the ladder, a human is in the loop for every meaningful decision. At the top, the agent is making sequences of consequential decisions with minimal human checkpoints. Everything that follows from that — the infrastructure requirements, the data access patterns, the failure modes, the governance surface — is downstream of that single variable.
This matters for how you price, scope, and position an engagement. A buyer who thinks they're procuring a retrieval system but is actually describing an agentic workflow is going to be surprised by the infrastructure cost, the integration complexity, and the security review scope. A buyer who thinks they need an agent but actually needs a well-designed workflow is going to overspend and underdeliver. Both conversations go wrong the same way: someone conflated rungs.
What This Chapter Covers
The sections that follow are a guided tour up the ladder. Each rung gets its own treatment: what it actually does mechanically, where it fits in a buyer's environment, what questions to ask before positioning it, and where the common misconceptions live.
The goal isn't to make you an AI architect. It's to make you the person in the room who can hear "we want to use AI to automate our case intake process" and know immediately which rung that lives on, what the real requirements are, and what the conversation needs to cover before anyone talks about a solution.
That's a specific and useful skill. The rest of this chapter builds it.
IDAM Bridge — In identity, authenticator assurance levels (AAL1, AAL2, AAL3) work as a spectrum with discrete, non-interchangeable tiers — you don't apply AAL1 controls to an AAL3 requirement, and the tiers aren't a sliding scale you can split the difference on. The AI deployment spectrum works the same way: each rung has distinct requirements, and applying the wrong governance posture to the wrong rung is the failure mode. It diverges here: AALs are anchored in ratified standards — NIST 800-63B, OMB M-19-17 — so you can point a skeptical buyer to a document. The AI deployment spectrum has no equivalent ratified taxonomy yet. You'll be building the case from first principles in every conversation, which means you need to understand the underlying logic, not just the labels.