Agents in depth
Tool calls, loops, stopping conditions: what an agent actually is, why long chains become unreliable, and how to bound them.
The idea
A language model can only produce text. An agent emerges when you give it a list of tools and read its generated text as a call to one of them: "search the database for X", "create an appointment", "send a message".
The result goes back to the model, which then decides what to do next. That loop is the whole mechanism.
What it is good for
- Multi-step research where the next step depends on the result.
- Bringing a process across several systems together.
- Routine tasks with branches that fixed automation does not cover.
The loop
- 01
Assemble context
Task, available tools, history so far.
- 02
Let the model decide
Either an answer or a tool call with parameters.
- 03
Execute the tool
With permission check, timeout and error handling.
- 04
Append the result and repeat
Until an answer exists, the step limit is reached, or a stopping criterion triggers.
Describing tools properly
A tool description is a prompt and is often treated like API documentation. That is the most common reason for wrong calls.
- State when the tool should not be used, not only when it should.
- Put units, formats and ranges in the description, not only in the schema.
- Word error messages so the model can derive the correction from them.
- Offer no more than about fifteen tools at once; beyond that selection accuracy drops sharply.
Why long chains fail
| p per step | 5 steps | 10 steps | 20 steps |
|---|---|---|---|
| 0.90 | 59 % | 35 % | 12 % |
| 0.95 | 77 % | 60 % | 36 % |
| 0.99 | 95 % | 90 % | 82 % |
The design rule follows: keep chains short and make intermediate results checkable. An agent with five steps and a check after each is more reliable than one with twenty unchecked.
The safeguards that actually work
| Measure | Against |
|---|---|
| Permissions per tool, not per agent | Unwanted writes |
| Hard step and time limits | Infinite loops, cost blowouts |
| Confirmation before irreversible actions | Deleting, sending, paying |
| Dry run with preview | Wrong bulk changes |
| Complete log per call | Traceability, supervision |
| Separate context per task | Mixing of unrelated data |
Prompt injection as an operational risk
As soon as an agent reads external content, such as a web page, a document or an email, that content can contain an instruction aimed at it. This is not theoretical: it is the most practically relevant weakness of agentic systems.
- Never treat read content as an instruction, only ever as data.
- Tools that send data outward only with explicit confirmation.
- Never take recipients, target URLs or endpoints from read content.
- When something looks off, quote the passage in the log and halt the task.
Evaluation
An agent is judged on its result, not its prose. The evaluation set therefore consists of tasks with a checkable end state: is the record created? Are the fields right? Was no second one created? Success rate, mean step count and cost per completed task are the three numbers that matter.
Related courses and sources
ENISA publications
Reports from the EU cybersecurity agency, including on securing AI systems and on the threat landscape. Free and in a European frame.
For security leads who need a European frame of reference rather than an American one.
Hugging Face agents course
Tool calls, planning, and the safeguards without which an agent is not viable in operation. Hands-on, with runnable code.
For anyone building an agent who needs to know which safeguards belong with it.
LangChain documentation
Building blocks for retrieval, tool calls and agents. Useful as a catalogue of the patterns, even if you end up building without the framework.
Useful as a catalogue of patterns, even if you end up building without the framework.
OWASP Top 10 for LLM applications
The list of weaknesses that actually occur in systems built on language models, from prompt injection to insecure tool integration.
For anyone building. The list replaces no review, but it is the best starting point for one.
Short courses on AI tooling
Units of around an hour on prompting, retrieval over your own documents, agents and evaluation. Free, and close to what is actually being deployed.
For practitioners with a specific question; a unit takes about an hour.