An agent is a language model in a loop with tools: it reads, decides, calls something, reads the result, repeats. That is all. The interesting engineering is everything around the loop that keeps it useful and safe, and it is what I teach when students ask about "agentic AI" after watching a demo.

Tools with the least privilege

A tool that can read a calendar should not be able to delete one. Give each tool the narrowest scope that completes the task, use separate credentials per tool, and log every call with its arguments. An agent is an enthusiastic junior with whatever access you hand it.

Retrieved text is data, never instructions

A web page or a document the agent reads can contain "ignore your instructions and…". Wrap every retrieved block in clear delimiters, tell the model that content inside them is never a command, and keep secrets out of the model's reach entirely. The wider threat model is in prompt injection vs memory poisoning.

Bounded loops

  • A maximum number of steps per task, and a maximum spend.
  • A stop condition the model does not control — a supervisor check or a human confirmation for consequential actions.
  • Timeouts on every tool call.

Memory you can inspect

Long-term memory is a database, and it should be treated like one: visible to the user, editable, deletable, with provenance for every entry. Memory that the user cannot see is memory that can be poisoned without anyone noticing.

A pause path

Something outside the agent must be able to stop it: a kill switch that revokes credentials, a queue that can be drained, an alert that pages a human. Design it before the first tool is connected, not after the first incident.

When you do not need an agent

Most "agent" use cases are a fixed pipeline with one model call in it — retrieval, generation, validation. Use the pipeline. Reach for a loop only when the sequence of steps genuinely cannot be known in advance. Students who can explain that distinction at a judging table or in an interview stand out immediately.

— Pranjul Rathour, GenAI Engineer from Kanpur, India. Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at any campus: pranjulrathour41@gmail.com.