What it can do: about what you can
The honest answer to "what can an agent do with software" is: roughly what a capable employee at a terminal can do. It reads screens and data, calls functions in the software, and takes the same concrete actions a person would — look something up, fill in a form, submit a request, place an order — within the permissions it has been granted.
The rule of thumb is close to true: if a task can be done through software a human uses, an agent can usually be wired to do it too. There is no short, fixed list of "things agents can do." There is whatever the surrounding software exposes.
The real question is permission, not ability
Because ability is broad, the sharp question is not can it? — it almost always can — but which tools is it allowed to touch, and with what authority?
- An agent with read-only access can look at everything and change nothing.
- An agent handed the order button can place orders — and only that, if that is all you grant.
- An agent with an approval step in the way must stop and wait for a human before the irreversible action.
What an agent does is therefore bounded by what you let it reach, not by some innate list of powers. This flips the design conversation from "is it capable enough?" to "what should it be permitted?" — which is the safer, more useful question, and the one the rest of this course keeps returning to.
See it in kestrel
Kestrel is exactly this: an agent at a market terminal, but with the reach it is granted made explicit and revocable. Watch one act on a generic instrument, no signup, no card:
npx kestrel.markets sim fomc-rate-decision-whipsawIt prints a certified proof URL you can recompute yourself. Drop the kestrel.markets MCP server into your client and the terminal is there again next session — no account in between.