Agents, Tools, and Guardrails
Recognize agentic behavior, choose the simplest sufficient design, and place enforceable controls around loops that can affect real systems.
By the end
You will be able to
- Distinguish a model response, deterministic workflow, and agentic loop.
- Define goals, state, tools, exit conditions, budgets, and human handoffs.
- Place enforceable guardrails around permissions, inputs, outputs, actions, and state.
- Evaluate and recover from looping, drift, unsafe actions, and incomplete handoffs.
Choose the simplest sufficient system
A model call produces an output. A deterministic workflow follows code-defined steps. An agentic loop lets a model choose among tools or actions, observe results, update state, and continue toward a goal. Products such as chat assistants and copilots may contain agentic features, but a product name alone does not prove that every interaction is agentic. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Use an agent only when model-directed adaptation adds value beyond a fixed workflow. Define the user goal, permitted scope, observable completion criteria, unavailable actions, maximum turns, time and cost budgets, and conditions that return control to a person. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Goal: [BOUNDED OUTCOME]
State: [INPUTS, MEMORY, ARTIFACTS]
Tools: [READ AND ACTION TOOLS]
Authority: [PERMISSIONS AND APPROVALS]
Checks: [STEP AND FINAL POSTCONDITIONS]
Budgets: [TURNS, TIME, COST, CALLS]
Exit: [SUCCESS, STOP, FAILURE, HANDOFF]
Recovery: [RESUME, ROLLBACK, ESCALATE]Run a visible observe, decide, act, and check loop
Each step should expose the current goal, relevant state, selected tool, resolved target, expected effect, and next stopping test. The surrounding application validates tool calls and permissions before execution; the model does not grant itself authority. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Start with one agent and the smallest useful tool set. Add routing, specialist agents, or handoffs only when measured failures show that a simpler design cannot reliably handle the task. Every handoff needs a versioned state contract and a clear owner of the next decision. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
{
"contractVersion": "1.0",
"executionBoundary": "bounded-task",
"inputValidation": {
"maxTokens": 4096,
"allowedModalities": ["text", "json"]
},
"outputSchema": {
"type": "object",
"required": ["status", "evidence", "confidence"],
"properties": {
"status": { "type": "string", "enum": ["verified", "rejected"] },
"evidence": { "type": "array", "items": { "type": "string" } },
"confidence": { "type": "number", "minimum": 0.0, "maximum": 1.0 }
}
}
}Evaluate trajectories and final outcomes
A plausible final answer can hide unsafe or wasteful steps. Review the trajectory: tool selection, targets, arguments, state changes, approvals, retries, handoffs, and stop decisions. Verify final postconditions in the affected system. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Build evaluations from representative success, boundary, adversarial, and recovery cases. Measure task completion, policy compliance, tool accuracy, duplicate effects, unnecessary steps, latency, cost, escalation quality, and whether the evidence supports the agent's claimed result. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Stop and recover from drift or partial execution
Bounded agents stop on achieved goals, denied authority, invalid state, repeated non-progress, exceeded budgets, unsafe requests, uncertain outcomes, or failed checks. Continuing is not success when the loop has lost a reliable path to the goal. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Persist a resumable checkpoint without secrets, reconcile real side effects, and classify completed, failed, unknown, and unattempted steps. Resume only from verified state. Compensate, roll back, disable a tool, or transfer control when recovery requires different authority. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Enforce guardrails outside the model
Use scoped credentials, tool allowlists, typed validation, exact-target approval, data minimization, content and policy checks, rate and cost limits, sandboxing, audit records, postcondition verification, and human handoffs. Treat retrieved content and inter-agent messages as untrusted data. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Layer guardrails because no single prompt, classifier, model, or reviewer covers every failure. Test bypass attempts and fail closed when identity, target, permission, or outcome is uncertain. Guardrails should make safe completion easier while stopping consequences outside the run contract. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Practice activity
Design and challenge a bounded agent loop
- Choose a task that may benefit from adaptation and compare a model call, deterministic workflow, and agentic loop. Justify the simplest sufficient option.
- Complete the run contract with goal, state, tools, authority, checks, budgets, exits, handoff, and recovery.
- Trace one successful trajectory and record every tool, target, state change, approval, postcondition, and stop decision.
- Challenge the design with repeated non-progress, an untrusted tool result, and a timeout after an external write; record the stop and recovery behavior.
What to produce
- A design comparison and complete run contract tied to an observable goal.
- One successful trajectory and three failure trajectories with postcondition, audit, handoff, and recovery evidence.
Reflect before continuing
Which part of your task became safer or simpler when you removed autonomy?
Evidence
Sources and verification
- Building effective agentsAnthropic · verified 2026-07-27
- A practical guide to building agentsOpenAI · verified 2026-07-27
- AgentsGoogle · verified 2026-07-27
Knowledge check
Make it stick.
Choose the strongest answer for each question. Your attempts become part of your account transcript.