Resource
Artificial intelligence: what actually contains what
Four concentric rings: AI and machine learning on the outside, then generative AI, then AI agents, then agentic AI at the centre. The diagram circulates every few weeks and gets called a map of the field. Three of those four rings are genuine subsets. One is not a subset at all.
Generative AI is not wider than machine learning. It sits inside deep learning, which sits inside machine learning, which sits inside AI. It is the innermost box, not the outer one. Agents are not a fourth stage of intelligence either. They are the same models with tools, memory and write access attached. The jump is in blast radius, not in reasoning.
In my experience the second error is the expensive one. Boards approve agent deployments on the assumption that a more autonomous system is a more capable one. It is not. It is the same model holding more permissions, and permissions are the one part of this you can actually govern.
The containment, in order
Read outside in. Each box is fully inside the box around it.
Artificial Intelligence
The supersetSystems that perform tasks we associate with human reasoning. Not everything in here learns. A large share of AI running in production today is a rules engine or a search algorithm.
Symbolic & rules-based AI
Omitted from the ring versionBehaviour written by humans as logic, not learned from data. Sits beside machine learning, not beneath it.
- Algorithms
- A* and Dijkstra search · minimax with alpha–beta pruning · constraint satisfaction · forward and backward chaining · PDDL planners
- Use cases
- Route and fleet optimisation · shift scheduling · tax and benefits determination · underwriting rules · chess and game engines · clinical decision support
- Tools
- Google OR-Tools · Drools · CLIPS · Neo4j and other knowledge graphs
Machine Learning
Subset of AILearns parameters from data instead of following written rules. Still where most enterprise value sits.
- Supervised
- Linear and logistic regression · decision trees · random forest · gradient boosting (XGBoost, LightGBM) · support vector machines · k-nearest neighbours · naive Bayes
- Unsupervised
- k-means · DBSCAN · hierarchical clustering · PCA · t-SNE · isolation forest · association rules
- Reinforcement
- Q-learning · SARSA · DQN · PPO
- Use cases
- Credit scoring · churn and demand forecasting · fraud and anomaly detection · recommendations · predictive maintenance · pricing
- Tools
- scikit-learn · XGBoost · Databricks · SageMaker · Vertex AI · Azure ML
Deep Learning
Subset of MLMulti-layer neural networks that learn their own features rather than being handed them.
- Architectures
- Multilayer perceptron · convolutional networks (ResNet, YOLO) · recurrent networks (LSTM, GRU) · graph neural networks · autoencoders · transformers
- Use cases
- Defect detection on a production line · medical imaging · OCR and document extraction · speech recognition · translation
- Tools
- PyTorch · TensorFlow · JAX · Hugging Face
Generative AI
Subset of deep learningLearns a distribution, then samples new output from it. The innermost box, not the outer one.
- Algorithms
- Transformer decoders (the LLM family) · latent diffusion · denoising diffusion · generative adversarial networks · variational autoencoders · flow matching
- Use cases
- Drafting and summarising · code generation · image, video and audio synthesis · retrieval-augmented question answering · synthetic test data
- Models
- Claude · GPT · Gemini · Llama · Mistral · Stable Diffusion · Midjourney · Whisper
Not subsets. Architectures.
These two wrap the boxes above rather than sitting inside them. Same models, different permissions.
Sequences any box above
Workflows
Not a subsetA model called at fixed points along a path a person wrote in advance. The sequence is decided by code; the model fills in the steps. Most of what gets sold as agentic today are workflows.
- Made of
- A model · a predefined code path · triggers and schedules · validation and approval gates · retries and fallbacks
- Patterns
- Prompt chaining · routing and classification · parallelisation (sectioning, voting) · orchestrator and worker · evaluator and optimiser · retrieval pipelines
- Use cases
- Invoice extraction into validation into posting · document classification and routing · drafting behind a review gate · alert enrichment · nightly reporting · KYC checks
- Tools
- n8n · Zapier · Make · Airflow · Temporal · AWS Step Functions · Power Automate · LangGraph
A workflow fails where you put the gate. An agent fails somewhere nobody wrote down.
Wraps any box above
Agents & agentic systems
Not a subsetAn architecture built around a model, not a smarter class of model. The same generative model becomes an agent when you give it tools, memory, a planning loop and write access. Nothing about the model changed.
- Made of
- A model · tool and API access · memory or state · a planning loop · a permission set · an audit trail
- Patterns
- Function and tool calling · ReAct · plan-and-execute · reflection and critique loops · single agent versus multi-agent orchestration · Model Context Protocol
- Use cases
- Ticket triage and resolution · CRM and record updates · contract review pipelines · code migration · SOC alert triage · outbound sales sequencing
- Tools
- LangChain and LangGraph · CrewAI · AutoGen · Semantic Kernel · n8n · Claude Code · Codex · Copilot Studio
Autonomy is a permissions decision, not a capability tier. A weak model with write access is more dangerous than a strong model with read access.
What the four-ring version gets wrong
- It puts generative AI outside machine learning. Generative AI is deep learning, which is machine learning. Drawing it as a wider ring reverses the containment.
- It implies all AI learns. The rules engine deciding your insurance excess is AI and has no training data anywhere in it.
- It treats agents as a fourth stage of intelligence. Same models. More permissions. The jump is in blast radius, not in reasoning.
- It files governance as a term inside the outer ring. Governance is not the last thing you reach on the way out. It runs through every box, at every level.
Governance runs as columns, not as a ring
Three columns cut vertically through every box above. A control that only exists at the outer ring is a control that exists nowhere.
Human capability
Named owners who hold launch-hold, budget and escalation authority — not a control point in a diagram.
Governance
Decision rights, oversight and measurement. Regulatory alignment is a sub-obligation inside this, never the point of it.
Supply chain
Models, data, weights, tooling and agent identity — everything you did not build and still answer for.
The ground: Baseline AI literacy sits under all three columns and cuts across all of them. Without it the other three become paperwork.
Where to go next
The Governance Memo is the monthly, board-facing version of this work — one breach post-mortem and two or three governance items, read by directors and CISOs.
What each AI tier actually decides takes the same workflow-versus-agent boundary and maps it against regulatory exposure and reversibility. Cyber terms for the boardroom does the equivalent job for cybersecurity.
If you came here from YouTube, promiseandrisk.ai carries the episode notes, sources and explainers for the education track.
The framework behind all of this is set out in full in Columns Not Layers, the practitioner’s guide to AI governance.