Agents
Models that take actions: tools, loops, memory, multi-agent systems and keeping them safe.
Sections
Interview questions answered at staff level
Agent fundamentals
What makes something an agent, tool use, the agent loop, and when a workflow is better.
10 questions02Agents in production
Reliability, cost, evaluation, security and human oversight for agents that run for real.
10 questionsRead first
Blog posts for this volume, easiest first
What is an AI agent, really?
A chatbot tells you how; an AI agent goes and does it, deciding each next step from what it just found. A plain-English tour of the loop, the tools, and why limits are part of the design.
Build your first tool-using agent (offline, in pure Python)
A minimal agent loop that speaks the real Messages API shape: tool calls linked to results by id, several calls per turn, argument validation that does not swallow your bugs, a step budget, pytest, and the same loop against Claude.
Workflows before agents: pick the simplest pattern that works
Seven patterns from Anthropic’s taxonomy, from one call to a fully autonomous AI agent, with the cost and latency spread of each and the failure that justifies climbing to the next.
Securing agents: assume the model will be fooled
Prompt injection has no reliable filter, so agent security is architecture: break the lethal trifecta, constrain what a fooled model can do, and test it like any other regression.
Build your first MCP server
What the Model Context Protocol actually standardises, a 30-line Python server with one tool and one resource, how to plug it into a client, and the security rules that matter before anyone else installs it.
Tool design for agents: the interface is the product
Names, schemas, error messages the model can act on, pagination, idempotency keys and confirmation for side effects, with runnable examples of a bad tool, a good one and an idempotent write.
Durable agents: checkpoints, idempotent tools and approvals that wait for days
An agent run is a long-lived workflow that will be interrupted. How to checkpoint each step, make every side effect safe to replay, resume at step 7 after a crash, and park a run for a human without holding a worker, with a runnable stdlib example.
Key terms
31 pages with diagrams and quizzes
A system where the LLM directs its own steps and tool calls in a loop until the goal is met or a stop condition fires (Anthropic, Dec 2024).
Workflows run LLMs through code paths you wrote; agents let the model pick the path. Anthropic's 2024 split; trade predictability for flexibility.
The model emits a structured call (tool name + JSON arguments); your application validates and runs it, then returns the result to the model.
The core cycle of every agent: model decides, host runs a tool, result is appended, repeat until a final answer or a stop condition.
Having the agent write out the steps for a goal before acting, then executing and re-planning when a tool result contradicts the plan.
The model critiques its output or trajectory and revises it; it helps when the critique uses an external signal (tests, validators), not self-review alone.
A fixed sequence of LLM calls, each feeding the next, with programmatic gates between steps — the first workflow pattern in Anthropic's 2024 list.
Several LLM agents with separate contexts, instructions and tools cooperating on one task: strong for parallel breadth, ~15× chat tokens.
A lead model splits a task into sub-tasks at run time, dispatches them to workers (calls or agents), then merges results — Anthropic's 4th pattern.
One agent transfers control of a conversation or task to another agent or a human, passing a structured briefing and swapping tools and permissions.
Model Context Protocol: an open JSON-RPC standard connecting AI apps (hosts) to servers exposing tools, resources and prompts. Linux Foundation since Dec 2025.
How an agent keeps information beyond one context window: working memory in context, plus long-term stores it writes to and retrieves from.
Deciding exactly what enters the model's context at each step — instructions, tools, retrieved data, history — to maximise signal per token.
An agent operating a graphical interface from screenshots via mouse and keyboard actions — the fallback for software with no API.
An isolated environment where an agent's code and actions run with scoped files, network and credentials, so mistakes can't reach real systems.
Checks around an LLM or agent that block, modify or escalate unsafe inputs, outputs and actions — layered, with the critical ones in code.
A person reviews, approves or corrects an AI's work at chosen points — usually before irreversible or high-stakes actions.
Rules that end an agent loop: task done, or a cap on turns, tokens, time, spend, repeated actions or errors — each with a logged reason.
Running agent workflows so progress is checkpointed and they resume after crashes, deploys or long waits without redoing completed side effects.
Evaluating an agent's whole path — tool choices, arguments, order, safety, efficiency — and its end state, over repeated trials (pass^k).
Designing an agent's tools — names, descriptions, parameters, outputs, errors — so the model picks and uses them correctly and cheaply.
What an agent run costs in tokens, money and time. It grows quadratically with turns unless cached, so manage it as a distribution per success.
Serving many customers from shared infrastructure while keeping their data, quotas and performance isolated. Isolation tier is a cost vs risk choice.
One tenant's heavy load (a bulk import, a runaway agent) degrading latency or quota for everyone sharing the same infrastructure.
Access control list: who may see a document. In RAG, ACLs must be enforced at retrieval time or the model will quote what the user can't open.
When a security check can't run (auth service down, classifier timeout), deny by default. The opposite, fail-open, keeps serving and skips the check.
Text that the model reads as instructions: typed by a user (direct) or hidden in a page, email or doc the agent reads (indirect). No filter fully fixes it.
Getting data out of a system without authorisation. For agents: via a tool call, a fetched URL, or a rendered markdown image carrying data in its query string.
Give each user, service and agent only the permissions its current task needs, for only as long as it needs them. Limits damage when it's tricked or buggy.
How much breaks when one thing fails or is compromised: how many users, tenants, records or actions. Design to keep it small and known.
Stacking independent controls so one failing (and each will sometimes) doesn't mean compromise. For LLM agents, no single layer is reliable alone.