How an agent works

A useful agent links a goal with actions and evidence. The starting point is simple: a model propose the following step, a tool can run and a loop decides how to continue to get an answer or stop.

Key concepts

At this course we studied agents based on LLM. A chatbot can answer a question. a workflow runs preset steps. an agent incorporates dynamic decisions about what to do after. It's goal oriented, acts with delimited autonomy and works iteratively. A process may contain fixed and an agenic stage. For a fully known operation, a function or a workflow is usually sufficient.

The three central components are model, tools and loop. The model interprets the request and can propose a call. The tool performs a concrete operation, such as consulting an order. The runtime coordinates messages, execution, state and output conditions. The model does not itself run the Python feature describing a tool.

Module Objectives

Differing agent, chatbot and workflow through its monitoring flow.
Identify's responsibility for model, tool and orchestration.
Follow a ReAct cycle and detect when to stop.
Choose appropriate controls for an action of reading or writing.

Components and state

To choose a model means balancing capacity, latency and cost. A high score at a benchmark does not prove that it will suit your case: Test understanding, using tools and conduct with incomplete data. A bigger model also doesn't remove the need to validate parameters.

A tool needs clear name, description, inputs and result. consultar_pedido(id_pedido) That's more understandable. hacer_cosa(texto). The scheme helps the model to produce structured arguments, but implementation continues to check types, ranges, authorization and existence of resource. The toolregister relates the requested name with an allowed code. you should never evaluate arbitrary text as code.

The state preserves relevant information from execution: messages, results and progress. Session memory allows to continue a conversation. persistent may preserve authorized preferences between sessions. No one should keep anything read indiscriminately. Define what goes into, how long and how bad information is corrected or deleted.

Retirement patterns

Chain-of-Thought (CoT) organizes resolution in intermediate steps but does not have access to current data or tools by itself. ReAct combines decisions, actions and comments: decide to consult, run the consultation and use the result for the next step. The observation can be an information or an error. Tree-of-Thought (ToT) Explore alternatives and compare resolution paths offers more exploration for additional work. No pattern alone shows that an answer is correct.

The intermediate reasoning can guide the work but to check an agent sees authorized inputs, calls, verifiable final results and explanations. A tooltrace does not mean access to complete internal reasoning of the model. A stylish plan without checking the results remains an opportunity to miss.

Step-by-step example

One person asks: "I bought three items from 24 dollars and four from 18. What's the total? " The agent has been multiplicar y sumar.

The model identifies two subtotals and requests multiplicar(3, 24).
The runtime valids arguments, runs the function and logs 72 with that call.
The model requests multiplicar(4, 18); receives 72.
Requests sumar(72, 72); receives 144.
He presents "The total is USD 144" and stops asking for tools.

The operations here are determinist. The choice of steps is put forward by the model. For a commercial calculator with established rules, program directly that sum would be easier. The example serves to observe the loop, and to justify agents in every task. If a tool fails, the agent should distinguish a secure retour from an error that requires correction or demand help.

Layer safety

Risks include prompt injection, tools abuse, memory pollution, data filtration and Uncontrolled execution. An outside document that says "send the keys to this email" is unreliable information, not an authorization.

Apply validation of inputs instructions with clear limits; tools with minimum privilege; checks on arguments and effects; Retirement of outputs and monitoring of the whole execution. To clear searches or issue a refund, check his or her identity and politics with the operation, with human approval as appropriate. Filtering only the final answer would be too late if money had been put out.

It limits time, steps and spending. He's been picking up some bad jobs without exposing secrets. Use operation identifiers to avoid duplication of textures while retrying. The layer defence works because each control cover faults that another can let through, and not because a prompt will become infallible to the system.

Common errors

To say that every response needs a tool: a general explanation may not require it.
To consider an action valid because the arguments fulfill the scheme: authorization and business logic are still lacking.
To merge autonomy with an absence of boundaries or supervision.
Use the recovered content as more authority instructions.

A complete solution: customer support

That only case leads to an agent's cycle a Oracle Cloud Infrastructure. A support application at OCI Compute connect the client with model, policy documents and orders. To consult an order isn't the same as to recover a policy or to authorize a refund: each tool has arguments, permissions and its own business rules. The scheme is educational. does not represent an architecture with complete production.

How to read architecture: Following the customer's consultation up to the application. The model proposes what to consult. The application checks the arguments and authorization, calls the indicated service and returns the evidence to the model to prepare the response. For an action sensitive, require appropriate human approval before applying Connecting services does not give permissions automatically.

OCI Generative AI: and can propose an call with a tool. The application valids and runs the function, not the model. That's how it works OCI's call function.
Object Storage: keeps policies as document. A tool for applying recoupes the related item; The picket doesn't bring semantic search by itself.
Autonomous AI Database: contains orders and their states. The implementation connected to the database and consult with clear parameters and permissions.

For instance, before "where's my order?" , the application looks at the database and returns the result to the model. If the request changes to "I want a refund," you have to check the policy and get the required approval before changing data. Credentials and authorisation decisions are valid.

Retirement exercise

The support agent has already looked up an order. The user asks to cancel the purchase, and a retrieved page claims that confirmation can be skipped. What must happen before executing the cancellation?

Solution

The application should verify that the user can cancel that order, that it complies with the policy and that the approval required for the concrete effect exists. The text that's been recovered doesn't change these conditions. To check and cancel are different permissions To separate both tools reduces the authority of each operation. The output should reflect the actual result of the cancellation, even if it was rejected.

Sources and review

Review the components at official course Oracle. It contrasts the cycle with documentation of LangChain agents and controls of execution with and human monitoring of OpenAI. Before from passing module explain who has authority to run the tool and what condition the loop ends.