1. Introduction
AI agents are systems that use AI models to perform tasks through one or more steps. Instead of producing only a single response, an agent can interpret a goal, decide what information or tools are needed, perform actions, inspect results, and continue until the task reaches an appropriate stopping point.
Agents are built from concepts already introduced in this module, including AI models, prompts, structured outputs, retrieval, function calling, tools, application logic, and security controls.
The important idea is that an agent is not simply an AI model. It is an application architecture that gives a model a controlled ability to work through tasks.
2. What Is an AI Agent?
An AI agent is an application that uses an AI model to determine or coordinate actions toward a defined goal, often across multiple steps.
An agent may use tools, retrieve information, maintain task state, evaluate intermediate results, and decide what should happen next.
The exact definition of an agent varies across the industry. For developers, it is useful to focus on the practical architecture rather than treating the word agent as a special type of model.
3. Simple AI Application vs Agent
A simple AI application may follow a predictable flow:
User input → AI model → Response
A tool-enabled application may add a controlled operation:
User input → AI model → Tool request → Tool result → Response
An agent can involve repeated steps:
Goal → Reason about next step → Use tool → Inspect result → Decide next step → Repeat → Final result
The important difference is the iterative workflow rather than the label used for the system.
4. Why Agents Are Useful
Some tasks naturally involve multiple steps.
For example, a research assistant might need to identify relevant sources, retrieve information, compare results, organize findings, and prepare a final response.
A business assistant might need to inspect customer information, retrieve an order, determine what action is appropriate, and prepare a response.
Agents can help coordinate such workflows when the steps cannot be conveniently reduced to one fixed operation.
5. The AI Model
The AI model is often responsible for interpreting instructions, understanding information, selecting possible next actions, and generating responses.
The model provides flexible language and reasoning capabilities, but it should not automatically receive unrestricted authority over the application.
The surrounding software determines which actions are actually available.
6. The Agent Goal
An agent normally starts with a goal or task.
The goal might be to research a topic, organize information, prepare a report, troubleshoot an issue, or complete a defined business workflow.
A clear goal helps constrain the system and provides a basis for determining whether the task is complete.
7. Tools
Tools give an agent access to capabilities outside the AI model.
Examples include:
- Searching a database
- Retrieving documents
- Calling an approved API
- Performing calculations
- Reading application records
- Creating a draft
Tool permissions should be limited to the capabilities required for the task.
8. Planning
An agent may need to determine which steps are required to accomplish a goal.
Planning can be explicit, where the application defines a sequence of steps, or more dynamic, where the model selects the next appropriate operation.
Dynamic planning can provide flexibility but also increases uncertainty and requires stronger controls.
9. Iterative Execution
One characteristic of agent systems is the ability to work through multiple cycles.
A cycle might involve receiving the current state, deciding on an action, calling a tool, receiving a result, and updating the task state.
The process can continue until the task is complete, a predefined limit is reached, or the system requires human intervention.
10. Agent State
Agents often need state to track what has already happened.
State may include the original goal, previous actions, tool results, intermediate findings, user information, and task status.
State should be designed deliberately. Storing every piece of information indefinitely can increase cost, privacy risk, and complexity.
11. Memory in Agent Systems
An agent can use short-term context for the current task and application-level memory for information that needs to persist.
Persistent memory should have a clear purpose and appropriate retention rules.
Developers should avoid assuming that every previous interaction needs to become permanent memory.
12. Agent Loops
A simplified agent loop can be represented as:
- Understand the current goal
- Inspect available context
- Determine a possible next step
- Request or use an approved tool
- Receive the result
- Evaluate the result
- Update the task state
- Continue or finish
The application should define limits around this loop.
13. Stopping Conditions
An agent should not continue indefinitely.
Useful stopping conditions can include successful completion, a maximum number of steps, a time limit, a cost limit, an unrecoverable error, or a requirement for human approval.
Explicit stopping conditions are important for reliability and cost control.
14. Human Approval
Some agent actions should require human approval.
For example, an agent might prepare a customer refund but require an authorized employee to approve the final transaction.
Human approval is especially useful when an action has financial, legal, operational, reputational, or privacy consequences.
15. Agents and Authorization
An agent should operate within the permissions of the user and application.
The AI model should not be able to grant itself additional permissions.
Every sensitive operation should be checked by the application before execution.
16. Agents and Least Privilege
Least privilege means giving a system only the access required for its intended task.
For example, a research agent may need read access to approved documents but should not have permission to modify customer records.
Limiting capabilities reduces the impact of mistakes and malicious instructions.
17. Prompt Injection in Agents
Prompt injection is particularly important for agents because an agent may act on information obtained from external sources.
A retrieved document, web page, or database record could contain instructions that attempt to influence the agent.
Applications should treat external content as untrusted data and maintain independent security controls around tool execution.
18. Agent Security Boundaries
A secure agent architecture separates model decisions from protected application operations.
The model can suggest an action. The application decides whether that action is permitted and executes it only when appropriate.
This boundary should remain in place even when the agent is highly capable.
19. Agent Privacy
Agents can process more information than simple chat applications because they may access multiple systems during a task.
Developers should minimize the information provided to the model and tools, restrict access to sensitive systems, protect stored state, and establish appropriate retention rules.
20. Agent Errors
Agents can fail in ways that do not occur in a simple single-response application.
An agent may choose an inappropriate tool, misunderstand an intermediate result, repeat an unnecessary operation, follow an incorrect plan, or stop at the wrong time.
Each stage therefore needs appropriate validation and error handling.
21. Tool Failure
A tool used by an agent may return an error, incomplete data, or an unexpected result.
The agent should not assume that every tool call succeeded.
The application can classify the failure, retry where appropriate, select an alternative workflow, or request human intervention.
22. Preventing Infinite Loops
An agent can sometimes repeat similar actions without making useful progress.
Applications should therefore impose limits such as maximum steps, maximum execution time, repeated-action detection, or task-specific completion criteria.
These limits protect both reliability and operating costs.
23. Cost Management
Agent workflows can consume more resources than simple AI requests because they may involve multiple model calls and tool operations.
Developers should monitor token usage, model calls, tool calls, execution time, and other relevant costs.
Efficient context management and appropriate stopping conditions can reduce unnecessary usage.
24. Observability
Agent systems should provide sufficient monitoring to understand what happened during a task.
Useful operational information can include task identifiers, tool calls, execution times, errors, completion status, and relevant evaluation results.
Logs should avoid unnecessary exposure of sensitive information.
25. Evaluating Agents
Agent evaluation should measure whether the system actually accomplishes its intended task.
Possible measures include:
- Task completion rate
- Accuracy of final results
- Correct tool selection
- Number of unnecessary steps
- Failure recovery
- Safety behavior
- Latency
- Cost per task
- Human escalation rate
26. Deterministic Workflows vs Agents
Not every multi-step task requires an agent.
If the workflow is predictable, traditional application code may be simpler, cheaper, and easier to test.
Agents are more useful when flexible interpretation or dynamic decision-making provides meaningful value.
27. Example: Research Agent
A research agent could receive a research question, search approved information sources, retrieve relevant material, organize findings, identify gaps, and prepare a draft report.
Each search or retrieval operation should be controlled by the application. The agent should not be given unrestricted access to arbitrary systems.
28. Example: Customer Support Agent
A customer support agent could classify a customer request, retrieve relevant account information, search approved support documentation, and prepare a response.
If the customer requests a high-impact action such as a refund, the application can require additional authorization or human approval.
29. Example: Business Operations Agent
A business operations agent could help analyze routine workflow information and prepare recommended actions.
Low-risk actions may be automated within defined limits, while higher-risk actions can require human approval.
This creates a practical balance between automation and control.
30. Agent Autonomy
Autonomy should be treated as a design choice rather than an objective by itself.
A highly autonomous system is not necessarily better if the task is sensitive or difficult to verify.
The appropriate level of autonomy depends on the consequences of errors and the ability to monitor and reverse actions.
31. Common Beginner Mistakes
- Giving an agent too many tools
- Allowing unrestricted external access
- Skipping authorization checks
- Assuming the model always chooses the correct action
- Having no maximum step or time limit
- Ignoring tool failures
- Allowing sensitive actions without confirmation
- Storing excessive agent memory
- Failing to monitor agent behavior
- Using an agent where a simple deterministic workflow would be better
32. A Practical Agent Architecture
A useful mental model is:
Goal → Context → AI Model → Proposed Action → Application Controls → Tool → Result → Evaluation → Next Step or Completion
The application controls remain between the model and important external operations.
33. Agents Are Applications, Not Magic
An agent does not automatically become reliable because a model can reason about a task.
Reliable agents require careful software engineering, well-defined tools, appropriate permissions, validation, monitoring, error handling, and evaluation.
The model provides intelligence within the boundaries established by the application.
34. When Not to Use an Agent
An agent may be unnecessary when a task has a short and predictable sequence of operations.
For example, if an application always performs the same three database operations in the same order, traditional application code may be more reliable than allowing an AI system to determine the sequence.
Agents should be introduced when their flexibility solves a real problem.
35. Where This Module Goes Next
The next lesson explains Working With Documents and Knowledge Bases. It focuses on how developers build AI applications that can work with larger collections of documents and organizational knowledge.
Conclusion
AI agents combine AI models with tools, context, state, application logic, and controlled execution to accomplish tasks through multiple steps.
The most important engineering principle is that autonomy should remain bounded by application controls. Authentication, authorization, validation, privacy, tool restrictions, stopping conditions, monitoring, and human approval are essential parts of responsible agent design.
A good agent is not simply one that can perform many actions. It is one that performs useful actions within clearly defined and testable boundaries.