AI agents

An AI agent is a system in which a large language model doesn’t just answer once, but works toward a goal in a loop: it decides on an action, calls a tool (search, a database query, an API, code execution), looks at the result, and decides the next step until the task is done.

Agents can handle tasks whose steps aren’t known in advance. That flexibility is also what makes them harder to control, test and secure than fixed workflows.

Diagram

flowchart LR
    goal[Goal from user] --> llm[LLM: decide next step]
    llm -- tool call --> tools[Tools: search, APIs, database, code]
    tools -- result --> llm
    llm -- needs approval --> human[Human review]
    human --> llm
    llm -- done --> out[Result]
    mem[(Memory and context)] <--> llm
    guard{{Guardrails: permissions, limits, logging}} -.- tools

How it works

• Tools are functions the model can call, each described by a name, a purpose and the inputs it takes.
• The agent loop. The model chooses a tool and its arguments; the application runs it and returns the result; the model continues.
• Context and memory. The conversation, tool results and any stored notes give the model what it needs for the next step.
• Guardrails. Permissions, spending and step limits, input checks and approval steps constrain what the agent can do.
• Workflows vs agents. When the steps are known, a fixed workflow that calls the model at certain points is simpler and more predictable. Agents earn their complexity when the path can’t be planned in advance.

Pros

• Handles open-ended tasks whose steps vary from case to case.
• Uses existing systems: tools wrap APIs and data you already have.
• Can recover from errors by observing a failed result and trying another approach.

Cons

• Less predictable: the same input can take different paths.
• Harder to test: behavior must be evaluated over many runs, not single assertions.
• Cost and latency: many model calls per task add up.
• Security risk: content the agent reads (web pages, emails, documents) can contain instructions designed to hijack it, known as prompt injection.

When to use it

• Tasks with variable steps: research, triage, troubleshooting, data gathering across systems.
• When a human can review the result, or actions are easy to undo.

When to avoid it

• Fixed processes with known steps. A deterministic workflow is cheaper and more reliable.
• High-stakes, irreversible actions (payments, deletions, external messages) without human approval.

Common pitfalls

• Too many tools, poorly described. The model picks the wrong one. Keep the toolset small and descriptions precise.
• Excessive permissions. Give each tool the least access it needs.
• No step or budget limits, letting a confused agent loop for a long time.
• No trace logging. Without a record of each decision and tool call, failures can’t be diagnosed or audited.

Related patterns

• Retrieval-augmented generation
• Human-in-the-loop approval
• Model gateway
• Orchestration vs choreography

Further reading

• Anthropic, “Building effective agents” (anthropic.com/research)
• Chip Huyen, AI Engineering