Agentless means Ansible installs nothing permanent on the managed nodes it controls. The control node connects to each managed node over SSH and pushes small programs called modules. It runs them there, then removes them when they finish. Windows nodes usually connect over WinRM instead.
A Linux or Unix managed node needs only Python and a user account Ansible can log in with over SSH. There is no daemon to install, upgrade or secure on every node.
Puppet works the other way. Each managed node runs a Puppet agent that pulls a compiled catalog from a primary server and applies it. That pull model corrects drift on every agent run, but every node needs the agent installed and maintained.
Ansible pushes changes when you run a playbook, so changes happen when you choose. ansible-pull inverts this, so each node fetches playbooks from Git and runs them itself, usually from cron.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓