AI Agents

An AI agent uses a model to choose actions in a loop, observe results, and continue toward a goal. This is useful when the next step genuinely depends on uncertain intermediate results. Prefer a fixed workflow when the steps are known: it is easier to test, secure, and operate.

Minimal Loop

goal + state → choose action → validate → execute → observe → update state → stop

Every loop needs maximum steps, time, tokens, cost, retries, and tool calls plus a clear success, failure, and cancellation state. Store durable workflow state outside the model context.

Tools

A tool should have a narrow name, typed input/output, explicit errors, idempotency behavior, timeout, and least-privilege credential. Validate model-produced arguments exactly as untrusted input.

Separate reading from mutation. Require confirmation or policy approval for high-impact, irreversible, external, financial, privacy-sensitive, or privilege-changing actions. Use preview/dry-run and idempotency keys where available.

Tool output is untrusted too. Web pages, documents, tickets, and repository text may contain instructions intended to override the agent. Keep policy in trusted code and prompts; do not let retrieved content grant authority.

Planning and State

Plans are hypotheses, not commitments. Replan after meaningful evidence but avoid endless self-critique. Use a state machine for business workflow status and let the model propose transitions that deterministic code validates.

Context is temporary working state. Summaries can lose facts, so retain source references and structured decisions. Long-term memory requires consent, scope, provenance, correction, retention, deletion, and protection against poisoning.

Protocols and Frameworks

Tool protocols can standardize discovery and invocation, but they do not make a tool safe. Authenticate both sides, restrict exposed capabilities, validate schemas, pin compatible protocol behavior, and audit calls. A framework is optional; a loop plus ordinary application state is often enough.

Multi-agent systems add coordination, duplicated context, inconsistent decisions, permissions, and cost. Use another agent only when independent context or parallel specialized work measurably improves the task.

Evaluation

Test complete trajectories, not only final prose:

• task success and output correctness;
• tool choice, arguments, and ordering;
• policy violations and unsafe attempted actions;
• recovery from timeout, malformed output, and partial completion;
• step count, latency, tokens, and cost;
• reproducibility across model versions;
• appropriate refusal, escalation, and stopping.

Run tools against sandboxes or fakes, then controlled real systems. Include adversarial observations and conflicting instructions.

Operations

Record model, prompt, tools exposed, tool calls, approvals, state transitions, outcomes, and costs with sensitive data minimized. Provide pause, cancel, replay-safe resume, and human takeover. Circuit-break repeated failures and revoke credentials independently of the model.

Checklist

• Is a model-directed loop necessary over a fixed workflow?
• Are authority, budgets, and stop conditions enforced outside the model?
• Are all tool inputs and outputs treated as untrusted?
• Can partial actions reconcile safely?
• Are memory and logs private, correctable, and deletable?
• Can a person inspect, interrupt, and take over?