Automation & AIModule 1: AI without the mysteryLesson 5 of 15
Course progress27%
20 min lesson · Updated August 2026
What is an AI agent?
An AI agent is a system in which a model pursues a goal through a loop that can inspect state, choose or call tools, observe results and continue—within permissions, budgets, stop conditions and human oversight.
What you will learn
By the end, you will understand:
Identify the parts of an agent loop
Distinguish agent autonomy from a single model response
Design tool permissions, approvals, limits and recovery
Visual explainer
See the idea clearly.
✓
A goal enters a loop of plan, choose tool, validate arguments, execute, observe and update; permissions, budgets, approval gates, logs and stop controls surround the loop.
An agent is a system, not only a model
Part
Job
Goal/instructions
Define the task, boundaries and completion conditions.
Model
Interpret context and propose next output or tool call.
State/memory
Store selected task information and prior results.
Tools
Search, read, calculate, send, write or change external systems.
Loop/orchestrator
Validate, execute, return results and decide whether to continue.
Controls
Limit permissions, cost, time, actions and require approvals.
A chatbot answer is not automatically an agent
A one-shot model response may generate text without taking external action. An agent can select tools, observe what happened and take another step. “Agentic” is a spectrum: a workflow may permit one constrained tool or broad multi-step autonomy.
Use the least autonomy needed. A deterministic workflow with one model classification can be safer and easier to test than an open-ended agent.
Tool calls need typed contracts
Define each tool’s purpose, required fields, allowed values, authorization and response. Validate model-generated arguments before execution. Never treat natural-language intent as sufficient permission for payment, deletion or disclosure.
Separate read tools from write tools. Give tools narrow scopes and short-lived credentials where possible.
Human approval belongs before consequence
Action
Control
Read public information
May be automated with source and injection protections.
Draft internal work
Review based on accuracy and confidentiality.
Send external message
Approval for sensitive, legal, financial or reputation-impacting content.
Spend, refund or purchase
Explicit amount limits, identity checks and confirmation.
Delete/change records
Preview, backup, scoped target and approval/rollback.
High-impact decision
Qualified accountable human decision; automation may assist, not silently decide.
An agent must know when to stop
Maximum steps
Maximum time and cost
Allowed domains/data
Tool-call rate limits
Success condition
No-progress detection
Repeated-error detection
User cancellation
Human escalation
Safe partial result
Rollback/compensation plan
Observe the whole run
Log instruction version, model, tool request, validated arguments, result, error, approval and final outcome without exposing secrets. Use trace IDs to connect events and keep retention appropriate.
Evaluate task completion, tool accuracy, unsafe attempts, permission denials, cost, latency and human corrections. A smooth conversation can hide a failed external action.
Threats increase with tools
01
Untrusted content enters
02
Model interprets it
03
Possible prompt injection
04
Proposed tool action
05
Policy/permission validation
06
Human approval if required
07
Execution in sandbox/scope
08
Result checked
09
Incident/rollback if unsafe
Real-world example
Example: controlled invoice-follow-up agent
Example
The agent reads only overdue invoices from an approved view, drafts reminders and asks a finance employee to approve each batch. It cannot change bank details, issue refunds or email outside the customer list. Step, amount and daily-send limits stop runaway behavior.
Try this
Draw an agent permission boundary
Choose one proposed agent. List every tool as read or write, the data scope, credential, maximum action, approval point, failure mode and stop condition. Remove any permission not needed for the first version.
Common questions
Questions beginners ask.
What is an AI agent?
A model-centered system that can pursue a goal through iterative state, tool calls, observations and controls.
Is every chatbot an agent?
No. A chatbot may only generate text; agents typically use a loop and tools to inspect or change external state.
What is a tool call?
A structured request for an external function or service to perform an operation or return data.
Should agents receive administrator access?
No by default. Use least privilege and separate narrowly scoped read/write permissions.
What is human-in-the-loop approval?
A person reviews and explicitly approves an action before a defined consequence.
Can an agent run forever?
It should not. Set maximum steps, time, cost, retry and no-progress limits.
What is prompt injection in an agent?
Untrusted content tries to redirect the model or trigger unauthorized data/tool behavior.
What should agent logs contain?
Enough context to trace instructions, tool calls, approvals, errors and outcomes without recording unnecessary secrets or personal data.
