An agent is a language model in a loop with tools: it reads, decides, calls something, reads the result, repeats. That is all. The interesting engineering is everything around the loop that keeps it useful and safe, and it is what I teach when students ask about "agentic AI" after watching a demo.
Tools with the least privilege
A tool that can read a calendar should not be able to delete one. Give each tool the narrowest scope that completes the task, use separate credentials per tool, and log every call with its arguments. An agent is an enthusiastic junior with whatever access you hand it.
Retrieved text is data, never instructions
A web page or a document the agent reads can contain "ignore your instructions and…". Wrap every retrieved block in clear delimiters, tell the model that content inside them is never a command, and keep secrets out of the model's reach entirely. The wider threat model is in prompt injection vs memory poisoning.
Bounded loops
- A maximum number of steps per task, and a maximum spend.
- A stop condition the model does not control — a supervisor check or a human confirmation for consequential actions.
- Timeouts on every tool call.
Memory you can inspect
Long-term memory is a database, and it should be treated like one: visible to the user, editable, deletable, with provenance for every entry. Memory that the user cannot see is memory that can be poisoned without anyone noticing.
A pause path
Something outside the agent must be able to stop it: a kill switch that revokes credentials, a queue that can be drained, an alert that pages a human. Design it before the first tool is connected, not after the first incident.
When you do not need an agent
Most "agent" use cases are a fixed pipeline with one model call in it — retrieval, generation, validation. Use the pipeline. Reach for a loop only when the sequence of steps genuinely cannot be known in advance. Students who can explain that distinction at a judging table or in an interview stand out immediately.
GenAI engineer and AI product builder with 2+ years shipping production-grade AI systems: RAG pipelines, fine-tuned LLMs, hybrid retrieval and multi-modal apps across vision, speech and OCR, architected end to end from ingestion to deployment. Leads engineering for SCULT INDIA's 14-member team, founded the 500+ member TechVerse Enclave community and has mentored 200+ students. Three hackathon first prizes: Changethon 2025 (IIT Roorkee), Product Genesis at Vividhotsava 2025 (CSJMU Kanpur) and BYTEBATTLE (MeetKats).
Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at colleges. Email pranjulrathour41@gmail.com.
