AI Agents and Tool Orchestration

Why it matters: "Agent" is the most overused word in AI. Knowing when you truly need an agent, and how to fence one in, saves money and prevents the kind of mistakes that email real customers.

By the end you can:

• Distinguish a single model call, a fixed workflow, and an agent
• Describe the agent control loop
• Bound an agent with limits and approvals
• Decide what should stay deterministic

Learn (15 min)

1. Three levels of autonomy (5 min)

Agent loop:

goal → choose action → call tool → read result → (done? ask a person? repeat)

Use the simplest pattern that works. More autonomy adds cost, delay, and new failure paths.

2. Bound the loop (5 min)

Set: allowed tools, maximum steps, time and spend budgets, stop conditions, and when to ask a human. Keep calculations, permissions, and business rules in ordinary code the model cannot overrule.

MAX_STEPS = 8
for step in range(MAX_STEPS):
    action = model.choose(goal, history, allowed_tools)
    if action.type == "finish": return action.answer
    if action.tool in NEEDS_APPROVAL: wait_for_human(action)
    result = run_tool(action)        # validated, permission-checked in code
    history.append(result)
escalate_to_human("step limit reached")

3. Control tool authority (5 min)

Separate read tools from write tools. Validate arguments server-side. Require confirmation for payments, external messages, account changes, and deletion. Plan for duplicate calls and timeouts with idempotency keys, and record intent and result for an audit trail. Treat tool outputs as untrusted text.

Apply (15 min)

Worked example (3 min). Lead-review assistant: fetch new leads assigned to me → classify with a short rationale → draft a reply using approved facts → validate recipient and content → show me the draft → send only after I approve → record the message ID. If a needed fact (price, date) is missing it asks me; it never guesses.

Lab (7 min): Agent or automation?

1. List three tasks from your work.
2. For each, decide: single call, fixed workflow, or agent. Justify in one sentence.
3. For the one you chose as an agent (or the closest), write the limits: allowed tools, max steps, budget, approval points, stop conditions.

Deliverable: A decision table and one agent specification. You're done when: Every write action in your spec has an approval or a hard restriction.

Check yourself (5 min)

1. What makes something an agent rather than a single model call?
2. When is fixed automation better?
3. Scenario: An agent retries a failed "create invoice" call and now there are two invoices. What control was missing?
4. Why keep business rules out of the prompt?
5. Name three limits that bound an agent.

Reference

Common mistakes

Cheat sheet: Use agentic behavior only when adaptive action helps; bound the loop; authorize every action in code; log what happened.

Key terms: agent, orchestration, idempotency, human-in-the-loop, least privilege.

Interview prompts: How do you decide if a task needs an agent? How do you prevent duplicate actions?

Go deeper: OpenAI Agents guide · Safety in building agents · MCP Specification

Next: Lesson 10 — evaluating, securing, and observing AI systems.