Most licence conversations collapse into "MIT is permissive, AGPL is strict". That is true and useless. The question that actually decides what you may build is one section of the AGPL, and it has a name: the network clause.
What the clause does
GPL has always had a trigger: if you distribute the software, you have to pass on the source. The distribution is the trigger. So a company that runs a modified copy of a GPL program on its own servers and never gives a copy to anyone is not distributing it, and the licence does not bite.
AGPL-3.0 adds section 13, and it changes the trigger. If you run a modified version and let other people interact with it remotely — a web service, an API, a network service — you must offer the corresponding source of your modified version to those users. You no longer need to distribute anything.
That is the whole difference. Everything else in AGPL is GPL.
Three cases
You use it, unmodified, as a service. Nothing is required. You did not modify it and you are not conveying it.
You modify it and run it for yourself, for staff, on an internal network. Section 13 speaks of interacting with the program "remotely through a computer network", and the GPL's own guidance on internal use is that this is not the case the clause targets. A company running a modified AGPL tool internally has not made the source available to the outside world, and the obligation does not arise. Teams still ask about this, and the answer is consistently that the trigger is conveying the modified version to users outside the group.
You modify it and offer it to users over a network. This is the case the clause was written for, and the obligation is real: the users of your service get the source of your modified version. You are not obliged to open-source your own application on top of it, which is the part people expect to be true and is not.
Why it exists, and who it is aimed at
Section 13 was added in 2007, and the reason is in the preamble: cloud providers were taking AGPL software, running a modified version, and never distributing it. The clause closes that route.
Which also means the target is the provider, not the user. If you deploy a modified AGPL application to your own users, you are on the other side of the line from the one it was aimed at.
What it looks like in practice
The projects tracked here make a useful sample. Forem and WriteFreely are AGPL-3.0, and so is Grafana. Discourse is GPL-2.0, which is the same trigger without the network clause. JupyterLab is BSD-3-Clause, Ollama is MIT, and Dify and n8n are not OSI licences at all — they are source-available with conditions of their own.
Read the LICENSE file, not the badge. That is the recurring advice on the Open Source board and it is repeated here because it keeps being needed: the badge on a GitHub page shows the base licence, and the exceptions live in the file.
/learn/agpl covers the licence itself, /learn/copyleft the family, and /learn/source-available-license the licences that are not open source but call themselves free.