What an agent can do

A production agent goes beyond chat. It decomposes objectives into steps, selects the right tools and sources, executes actions safely, and validates results before responding. Typical capabilities include structured information extraction, guided decision-making, workflow automation, and escalation to humans when uncertainty or risk is high.

Reference architecture

A robust agent is composed of separable layers: an interface (web, Slack, Telegram, email, API), an agent core (planning, execution, self-checks), a tool layer (APIs and internal services), a knowledge layer (RAG with citations), and observability (traces, metrics, quality signals).

Keeping these layers explicit enables consistent governance (RBAC/ABAC), controlled side effects, and repeatable evaluation.

Governed tool-calling

Tool-calling is constrained by schemas, permissions, and policy rules. Tools are exposed with strict input/output contracts (typically JSON Schema), and the agent can be limited to read-only operations or require human approval for any write action.

For sensitive operations, a two-phase approach is recommended: the agent proposes a dry-run plan with the exact tool calls it intends to execute, then proceeds only after validation.

Memory and context management

Memory is handled as a controlled subsystem, not as an implicit side effect of long conversations. Short-term conversational context is summarized and expired; long-term memory is explicitly written, versioned, and permissioned.

This prevents prompt drift and reduces the risk of persisting confidential or irrelevant information.

Security and safety controls

Agents operate in hostile environments: documents and user inputs may contain prompt-injection attempts. Agent patterns isolate untrusted content, prevent it from modifying system instructions, and enforce allow-lists for tools and actions.

Access controls are applied consistently across knowledge retrieval and tool execution, with audit logs for compliance and incident response.

Observability and evaluation

Every run produces a trace: plans, tool calls, retrieved sources, intermediate decisions, and final outputs. Operational metrics cover latency, token/tool cost, error rates, escalation rates, and tool stability.

Quality signals include citation coverage, groundedness (answers backed by sources), and regression testing via golden datasets.