Agentic AI for Complex Decision-Making: A Systematic Critical Review of Planning, Memory, Tools, Safety and Assurance in Autonomous Systems
This systematic critical review of 98 sources up to June 2026 evaluates Agentic AI's planning, memory, tools, and safety through a new closed-loop framework, revealing that intrinsic self-correction is unreliable, long-horizon planning remains weak, and tool-using agents are vulnerable to injection, while offering an auditable evidence matrix and a prioritized roadmap for future development.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a computer program that does not just answer a question when asked, but instead sets out to solve a problem on its own. It can look at a messy situation, break it down into steps, remember what it has learned, use digital tools like a web browser or a code editor, and even talk to other programs to get the job done. This is the promise of "agentic" artificial intelligence. For years, computers were excellent at predicting the next word in a sentence or recognizing a face in a photo, but they were reactive; they waited for a command. The new generation of these systems is proactive. They are designed to act over long periods, making a sequence of decisions to reach a goal, much like a human would when fixing a complex software bug or planning a scientific experiment. The question that has driven researchers for some time is whether these digital agents can actually be trusted to do this work reliably without constant human supervision.
A new, comprehensive review of the field, published by researchers from Vellore Institute of Technology and Universiti Tunku Abdul Rahman, takes a hard look at this question. The authors did not simply list the latest inventions or describe how these systems are built. Instead, they acted like auditors, gathering and weighing evidence from nearly one hundred studies published up to mid-2026. Their goal was to separate the genuine capabilities of these agents from the hype, checking whether the systems work as advertised when faced with difficult, multi-step tasks. They found that while the technology is advancing rapidly, there are significant gaps between what these agents can do in a controlled test and what they can do in the real world. The review suggests that the current generation of these systems is not yet ready for high-stakes, independent work, and that the path forward requires building specific safety structures rather than just waiting for the computers to become smarter.
The researchers began by organizing the chaotic landscape of agent research into a clear map. They identified that these systems rely on four main abilities: planning a course of action, remembering information over time, using external tools, and coordinating with other agents. They also noted a critical distinction between a system that simply follows a pre-written script and one that truly makes its own choices. To test the reliability of these systems, the authors proposed a standard framework that includes two safety checkpoints that are currently missing in most designs. The first checkpoint is a verification step, where a separate process checks the agent's plan before it is executed. The second is a safety gate, a rule-based barrier that prevents the agent from taking dangerous actions, such as deleting important files or sending private data to the wrong place.
When the team applied this framework to ten of the most prominent agent systems currently in existence, the results were sobering. None of the ten systems fully implemented both of these crucial safety checkpoints. Most of the systems were excellent at the "doing" parts—generating ideas, calling tools, and moving forward—but they were surprisingly weak at the "checking" parts. They often lacked a way to verify if their own plans were correct before acting, and they rarely had a hard stop to prevent harmful mistakes. The authors found that the machinery for taking action was far more developed than the machinery for ensuring that action was safe. This imbalance is dangerous because, as the researchers showed, small errors in planning tend to pile up over time. If an agent makes a mistake in the first step of a long task, that error can cascade, leading to a complete failure by the end, even if the agent seems to be making progress.
One of the most significant findings concerns the idea of self-correction. Many developers have hoped that these agents could simply look at their own work, realize a mistake, and fix it. The review found that this hope is largely misplaced. When an agent tries to correct itself without outside help, it often fails to notice its own errors or, worse, makes the problem worse. The evidence suggests that self-correction only works reliably when the agent receives feedback from an external source, such as a test result, a human reviewer, or a tool that confirms whether a step was successful. Without that outside voice, the agent is prone to getting stuck in a loop of confident but incorrect reasoning.
The review also examined the popular idea that using multiple agents working together is always better than using a single one. The researchers found that this is not automatically true. While teams of agents can solve complex problems, they often fail to outperform a single, well-designed agent if they are given the same amount of computing power. In many cases, the agents in a team end up repeating the same mistakes or getting confused by each other, a phenomenon known as "group hallucination." The benefits of teamwork only appear under very specific conditions, such as when the agents have different, non-overlapping skills and when their errors do not reinforce one another.
Perhaps the most critical insight from the review is about safety. The authors argue that safety cannot be an afterthought or a simple filter added to the end of a process. Because these agents can take real-world actions, safety must be built into the very structure of how they make decisions. The review highlights that current safety measures, which focus on training the computer to refuse harmful requests, are not enough. A system can be trained to be polite and refuse to say something bad, but if it is then tricked by a hidden instruction in a website it visits, it might still perform a harmful action. The researchers conclude that reliable agents need a "defense in depth" approach, where multiple layers of protection, including permission checks and sandboxed environments, stand between the agent's decision and the real world.
Finally, the team looked at how ready these systems are for real-world use in important fields like healthcare, finance, and public services. They found that for the highest-stakes areas, there is almost no evidence that these agents are ready to work independently. In domains like software engineering, where the risks are lower and mistakes can be easily undone, there is some evidence of success, but even there, the systems struggle with long, complex tasks. The review suggests that the current state of the technology is best described as a promising capability that is still waiting for the necessary infrastructure to make it trustworthy. The path forward is not just about building smarter models, but about building better systems for verification, safety, and accountability. The researchers propose a roadmap for the next few years that prioritizes these structural improvements, arguing that until these foundations are in place, the deployment of fully autonomous agents in critical areas remains too risky to justify.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.