AIYINGFrom AI Awareness to Accomplishment
Showing posts with label Agentic AI. Show all posts
Showing posts with label Agentic AI. Show all posts

Friday, November 13, 2026

AI Engineering Active Concepts #011 — Agent Evaluation: Measuring Whether AI Workflows Actually Succeed

AI ENGINEERING — ACTIVE CONCEPTS & PRACTICES | #011

Agent Evaluation: Measuring Whether AI Workflows Actually Succeed



Chapter 2: Engineering AI Applications and Agents

AIYING — Accomplishing with AI

The Big Idea: Agent evaluation measures whether an AI workflow completes its intended task correctly, reliably, safely, and efficiently.

Fluent responses and successful tool calls do not necessarily demonstrate successful task completion.

Engineering question: What evidence proves that an AI agent accomplished the intended business outcome?

Contents

  1. Why Agent Evaluation Matters
  2. UNDERSTAND — The Concept
  3. CONNECT — AI Engineering Relationships
  4. Evaluation Architecture
  5. APPLY — Enterprise Procurement Agent
  6. Worked Example: Evaluating 100 Workflows
  7. Engineering Decisions and Trade-offs
  8. Active Industry Practices
  9. ACCOMPLISH — Practical Exercise
  10. Student and Practitioner Project
  11. Check Your Understanding
  12. Active Connections
  13. References and Further Reading

1. Why Agent Evaluation Matters

Imagine a procurement AI agent assigned to investigate delayed purchase orders and recommend recovery actions.

During testing, it successfully calls the required tools, produces professional reports, and appears to follow the intended workflow.

But closer inspection reveals that some recommendations are based on outdated inventory, some approvals are missing, and several completed tasks were reported incorrectly.

The agent may look effective without being operationally reliable.

The success of an AI agent must be evaluated against the intended outcome, not merely the quality of its generated response.

2. UNDERSTAND — The Concept

What is agent evaluation?

Agent evaluation is the systematic assessment of how well an AI agent or agentic workflow performs defined tasks under specified conditions.

It examines the final outcome, intermediate decisions, tool interactions, operational constraints, and failure behavior.

Five evaluation dimensions

DimensionKey Question
CorrectnessDid the agent produce the right result?
ReliabilityDoes it succeed consistently across relevant cases?
EfficiencyHow much time and cost does execution require?
SafetyDid it respect permissions and operational boundaries?
UsefulnessDid the outcome help accomplish the real task?

Three levels of evaluation

Component evaluation: Tests individual operations such as retrieval, classification, and tool selection.

Trajectory evaluation: Examines the sequence of steps, tool calls, decisions, and state transitions.

Outcome evaluation: Determines whether the overall task was completed correctly.

Evaluation versus monitoring

Evaluation determines whether a system meets defined criteria.

Monitoring observes its behavior during operation.

Production traces and feedback can supply evidence for ongoing evaluation, but monitoring alone does not establish correctness.

3. CONNECT — AI Engineering Relationships

ConceptConnection to Evaluation
Context EngineeringTests whether the model receives relevant information
Retrieval EngineeringMeasures relevance, coverage, and evidence quality
Structured OutputsTests schema adherence and data accuracy
Tool CallingEvaluates tool selection and argument correctness
MCPTests external capability discovery and invocation
Agent OrchestrationEvaluates workflow progression and recovery
ObservabilitySupplies execution traces and operational signals
AI GovernanceDefines accountability, safety, and approval requirements
Token EconomicsMeasures execution costs and efficiency

Active connection: Evaluation turns the technical capabilities studied in earlier lessons into measurable engineering performance.

4. Evaluation Architecture

Define Intended Task and Success Criteria

↓

Build Representative Test Cases

↓

Execute Agent Workflow

↓

Capture Outputs and Execution Traces

↓

Apply Deterministic and Judgment-Based Checks

↓

Analyze Failures and Performance

↓

Improve and Re-Evaluate

Step 1 — Define success

Specify observable completion conditions, acceptable errors, and prohibited actions before testing.

Step 2 — Construct evaluation cases

Include normal cases, edge cases, ambiguous requests, incomplete data, tool failures, and authorization scenarios.

Step 3 — Run the workflow

Execute the system against controlled inputs using representative tools or simulated environments.

Step 4 — Capture evidence

Record final outputs, tool calls, execution state, latency, cost, and relevant decisions.

Step 5 — Score results

Use exact checks where objective answers exist and carefully designed human or model-based judgments where interpretation is required.

Step 6 — Diagnose failures

Determine whether failures originated in retrieval, planning, tool use, reasoning, authorization, or workflow execution.

Step 7 — Improve and retest

Repeat evaluations after changes and check for regressions in previously successful cases.

5. APPLY — Enterprise Procurement Agent

Scenario: Evaluating Purchase Order Recovery

A manufacturing organization uses an AI agent to identify delayed purchase orders and recommend recovery actions.

The system can retrieve order records, inspect alternative stock, examine procurement policies, and prepare approval requests.

What should be evaluated?

Evaluation AreaExample Test
Order retrievalDid the agent identify the correct purchase order?
Inventory accuracyDid it use current, authorized inventory data?
RecommendationIs the proposed recovery action feasible?
Policy complianceDid it follow procurement constraints?
Approval handlingDid it pause before restricted operations?
Execution reportingDid it distinguish proposed and completed actions?
Failure handlingDid it recover or escalate appropriately?

Why end-to-end evaluation matters

A system may retrieve the correct order and select the correct tool yet recommend an invalid stock transfer.

Conversely, it may produce a correct recommendation but fail to obtain mandatory approval.

Evaluation must consider the complete workflow and its operational requirements.

6. Worked Example: Evaluating 100 Workflows

Consider the following fictional test results for a procurement agent.

MeasureIllustrative Result
Total test cases100
Correct final outcomes82
Correct tool selection94
Correct tool arguments90
Approval violations2
Average execution time18 seconds
Average estimated execution cost$0.06

Assume each case contributes one binary result to each applicable measure, and all 100 cases are eligible for the listed accuracy checks.

Task success rate

Task Success Rate =
Successful Cases / Total Cases × 100

= 82 / 100 × 100
= 82%

Tool selection accuracy

Tool Selection Accuracy =
Correct Selections / Evaluated Cases × 100

= 94 / 100 × 100
= 94%

Approval violation rate

Approval Violation Rate =
Cases with Violations / Total Cases × 100

= 2 / 100 × 100
= 2%

For production evaluation, approval violations should also be measured against the subset of cases where approval requirements actually apply.

Interpretation

The agent selects tools correctly in most cases, but its final task-success rate is lower.

This indicates that tool selection alone does not explain overall performance.

More importantly, two approval violations indicate a control failure requiring investigation. A high average success rate cannot compensate for unauthorized consequential actions.

Engineering conclusion

The system requires root-cause analysis, stronger approval enforcement, and targeted regression tests before its suitability for production can be established.

7. Engineering Decisions and Trade-offs

DecisionBenefitTrade-off
Exact-match scoringRepeatable and objectiveMay reject valid alternatives
Human evaluationContextual judgmentTime and reviewer variability
LLM-as-judgeScalable qualitative assessmentBias and grading errors
Simulated environmentsSafe and repeatable testsMay differ from production
Production feedbackReal-world relevanceNoise and incomplete ground truth
Trace-level scoringDetailed diagnosisHigher evaluation complexity
End-to-end scoringMeasures task completionMay obscure root causes

Important evaluation risks

  • Unrepresentative test datasets
  • Ambiguous or incorrect reference answers
  • Overreliance on subjective grading
  • Data leakage between development and test sets
  • Ignoring rare but severe failures
  • Confusing fluent explanations with correct outcomes
  • Failing to retest after changes
  • Using averages that conceal critical failure cases

Recommended practices

  • Define success criteria before implementation.
  • Use representative and adversarial test cases.
  • Combine deterministic checks with calibrated human judgment.
  • Capture execution traces.
  • Separate quality, safety, latency, and cost measures.
  • Track performance by scenario and failure category.
  • Maintain regression test suites.
  • Investigate critical failures independently of aggregate scores.
Evaluation quality depends not only on the metric but also on the relevance of the test cases, the validity of the reference answers, and the consequences of failure.

8. Active Industry Practices

Established practices

  • Task-based benchmark datasets
  • Unit and integration testing for tools
  • Human review of model outputs
  • Automated regression testing
  • Latency and cost measurement
  • Failure classification and analysis

Evolving agent evaluation practices

  • Trajectory and trace evaluation
  • LLM-assisted grading
  • Simulation-based agent testing
  • Multi-turn and multi-step task evaluation
  • Continuous evaluation from production feedback
  • Risk-weighted evaluation of agent actions

Relevant technologies

Engineering teams may use OpenAI Evals and agent evaluation tooling, LangSmith, MLflow, or custom test harnesses depending on their requirements.

Evaluation tools do not replace the need for clearly defined business success criteria and valid test data.

Industry relevance

Agent evaluation is important in enterprise automation, customer support, software development, financial operations, procurement, research assistants, and other systems where AI-generated decisions influence operational outcomes.

Practice status: Established software testing principles combined with rapidly developing agent-specific evaluation methods.

Reviewed: November 2026.

9. ACCOMPLISH — Practical Exercise

Exercise: Evaluate a Procurement Agent

Consider a fictional agent that investigates delayed purchase orders.

Task: Recommend a recovery action.

Purchase order: PO-2056

Required quantity: 500 units

Alternative stock: 350 units

Approval: Required for stock transfer

Your tasks

  1. Define what successful completion means.
  2. Identify the required evidence.
  3. Write five normal test cases.
  4. Write three failure or edge cases.
  5. Define a scoring rubric.
  6. Identify critical safety checks.
  7. Specify the execution information to record.
  8. Describe how failures should be classified.
  9. Recommend a release decision based on the results.

Reusable AI-assisted prompt

Act as an AI engineering evaluation specialist.

Design an evaluation plan for a
fictional procurement AI agent.

The agent:
- Retrieves purchase-order information
- Checks alternative inventory
- Recommends recovery actions
- Requests approval when required
- Reports workflow outcomes

Provide:
1. Task success criteria.
2. Representative test scenarios.
3. Edge and failure cases.
4. Expected results.
5. Tool-use evaluation criteria.
6. Workflow trace checks.
7. Safety and approval tests.
8. Cost and latency metrics.
9. Failure classification.
10. Release-readiness recommendation.

Distinguish simulated test results
from real measured performance.

Accomplishment: Create an evaluation plan that measures whether an AI agent accomplishes its intended task safely and reliably.

10. Student and Practitioner Project

Mini Project: Build an Agent Evaluation Harness

Objective: Develop a small evaluation system for a fictional procurement agent.

Project requirements

  1. Define 20 representative test cases.
  2. Create expected outcomes for each case.
  3. Implement or simulate an agent workflow.
  4. Capture tool calls and execution results.
  5. Score final task completion.
  6. Check tool selection and argument correctness.
  7. Test approval compliance.
  8. Measure execution latency and estimated cost.
  9. Classify failed cases.
  10. Produce a performance report and improvement plan.

Suggested evaluation scorecard

MetricPurpose
Task success rateMeasures correct final outcomes
Tool selection accuracyMeasures correct tool choice
Argument accuracyMeasures correctness of tool inputs
Policy complianceMeasures adherence to operational rules
Recovery successMeasures handling of failures
Average latencyMeasures execution speed
Average costMeasures resource efficiency
Critical failure countTracks severe errors independently

Project deliverable: A test dataset, evaluation harness or design, execution traces, scorecard, failure analysis, and engineering recommendations.

11. Check Your Understanding

  1. What is agent evaluation?
  2. Why is fluent output insufficient evidence of success?
  3. How do component, trajectory, and outcome evaluations differ?
  4. What is the difference between evaluation and monitoring?
  5. When is deterministic scoring preferable?
  6. What are the limitations of LLM-as-judge evaluation?
  7. Why must critical failures be examined separately?
  8. How would you evaluate an agent before production deployment?

Reflection: If an AI agent achieves 98% task success but occasionally performs unauthorized actions, should it be considered production-ready? What additional controls or evidence would be required?

12. Active Connections

Coming next — #012: Observability and Tracing: Understanding What AI Systems Actually Do.

13. References and Further Reading

  1. OpenAI — Evaluation Guides
  2. OpenAI Evals — GitHub
  3. LangSmith — Evaluation Documentation
  4. MLflow — GenAI Evaluation and Monitoring
  5. NIST AI Risk Management Framework

Evaluation frameworks, metrics, and tooling evolve. Consult current documentation and validate scoring methods against the requirements of each application.


Final Takeaway

An AI agent is not successful because it completed a sequence of steps. It is successful when evidence demonstrates that it achieved the intended outcome correctly, safely, and reliably.

AI Engineering — Active Concepts & Practices
Active Concept #011 — Agent Evaluation

AIYING — Accomplishing with AI

Understand → Connect → Apply → Accomplish

AI Engineering Active Concepts #010 — Agent Orchestration: Designing Reliable Multi-Step AI Workflows

AI ENGINEERING — ACTIVE CONCEPTS & PRACTICES | #010

Agent Orchestration: Designing Reliable Multi-Step AI Workflows



Chapter 2: Engineering AI Applications and Agents

AIYING — Accomplishing with AI

The Big Idea: Agent orchestration coordinates the sequence, dependencies, tools, decisions, state, and controls required to complete multi-step AI tasks.

An individual model response may be useful. An orchestrated workflow must deliver a verifiable outcome.

Engineering question: How do we make an AI workflow reliable when it involves multiple steps, external systems, failures, and human approvals?

Contents

  1. Why Agent Orchestration Matters
  2. UNDERSTAND — The Concept
  3. CONNECT — AI Engineering Relationships
  4. Agent Orchestration Architecture
  5. APPLY — Enterprise Procurement Workflow
  6. Worked Example: A Multi-Step Workflow
  7. Engineering Decisions and Trade-offs
  8. Active Industry Practices
  9. ACCOMPLISH — Practical Exercise
  10. Student and Practitioner Project
  11. Check Your Understanding
  12. Active Connections
  13. References and Further Reading

1. Why Agent Orchestration Matters

Consider an enterprise procurement manager asking:

"Check purchase order PO-1048. Verify whether the required material is available elsewhere. If delivery is delayed, recommend a recovery action and prepare the necessary follow-up."

This is not a single question. It is a sequence of dependent tasks.

The AI application may need to retrieve purchase-order information, inspect inventory, compare delivery alternatives, apply procurement policies, prepare a recommendation, and obtain approval before making changes.

Each step depends on information or decisions from previous steps.

What happens if the inventory service is unavailable? What if the purchase-order record is inconsistent? What if a human reviewer rejects the proposed action?

These are orchestration problems.

Agent orchestration is not simply connecting several AI calls. It is engineering the control flow that turns multiple operations into a dependable business outcome.

2. UNDERSTAND — The Concept

What is agent orchestration?

Agent orchestration is the coordination of AI models, tools, workflow steps, decisions, application state, and control mechanisms to accomplish a task.

The orchestrator may be implemented through conventional software logic, a workflow engine, an agent framework, or a combination of these.

Five essential responsibilities

ResponsibilityEngineering Question
PlanningWhich steps are required?
CoordinationWhat should run next, and what depends on what?
State managementWhat has already happened?
ControlWhich operations are permitted?
RecoveryWhat happens when a step fails?

Workflow versus agent

A workflow generally follows a predefined control structure. An agent may dynamically select actions and tools based on intermediate observations.

In practice, production systems often combine both approaches.

For example, an agent may analyze a supplier delay while a deterministic workflow controls approvals, record updates, and completion status.

Common orchestration patterns

  • Sequential: Execute dependent steps in order.
  • Parallel: Run independent operations concurrently.
  • Conditional routing: Choose a branch based on validated results.
  • Iterative: Repeat a bounded process until a condition is satisfied.
  • Supervisor-worker: Delegate specialized tasks to different components.
  • Human-in-the-loop: Pause for an authorized decision.
  • Event-driven: Resume when an external event occurs.

Not every problem needs multiple agents. A deterministic workflow with one model and a few tools may be simpler, cheaper, and easier to test.

3. CONNECT — AI Engineering Relationships

ConceptRelationship to Orchestration
Context EngineeringSupplies relevant information to each step
Token EconomicsControls the cost of repeated model calls
Retrieval EngineeringProvides external evidence
Context ManagementPreserves state and continuity
Structured OutputsDefines data contracts between steps
Tool CallingInvokes external capabilities
MCPProvides standardized access to external capabilities
EvaluationTests both individual steps and overall outcomes
ObservabilityTraces execution, latency, cost, and failures
GovernanceEstablishes accountability and approval controls

Active connection: Orchestration brings together the capabilities studied in earlier lessons into an operational AI application.

4. Agent Orchestration Architecture

User Request

↓

Workflow Controller / Orchestrator

↓

Task Planning and State Initialization

↓

Model and Tool Execution

↓

Result Validation

↓

Decision: Continue, Retry, Escalate, or Stop?

↓

Human Approval When Required

↓

Authorized Business Action

↓

Outcome Verification and Audit Record

State transitions

A workflow should have explicit states, such as:

CREATED
   |
   v
RUNNING
   |
   +--> WAITING_FOR_APPROVAL
   |           |
   |           v
   |        RUNNING
   |
   +--> FAILED
   |
   +--> COMPLETED

Real implementations may need additional states such as cancelled, timed out, rejected, or requiring manual intervention.

Why state matters

State enables a workflow to resume after interruptions, avoid repeating completed actions, and distinguish a pending operation from a successful one.

State should be stored in a durable application system when the workflow must survive process restarts or extended human approval delays.

5. APPLY — Enterprise Procurement Workflow

Scenario: Recovering from a Supplier Delay

A manufacturing company uses an AI assistant to investigate delayed material deliveries.

The assistant has access to fictional procurement, inventory, and supplier systems.

Step 1 — Retrieve purchase order

The system obtains the current order status through an authorized lookup tool.

Step 2 — Check inventory

The application retrieves stock availability from alternative locations.

Step 3 — Evaluate alternatives

The AI analyzes available evidence and prepares possible recovery options.

Step 4 — Apply business constraints

Deterministic checks verify inventory eligibility, policy requirements, and permitted actions.

Step 5 — Request approval

If a transfer or supplier change requires approval, the workflow pauses for the designated decision-maker.

Step 6 — Execute authorized action

The application invokes the approved operation and verifies its result.

Step 7 — Complete and record

The workflow reports the outcome and records the relevant execution history.

Important: The assistant should never describe an operation as completed merely because the model proposed it.

6. Worked Example: A Multi-Step Workflow

The following is a fictional design illustration, not a live enterprise integration.

Sample workflow state

{
  "workflow_id": "WF-1048",
  "po_id": "PO-1048",
  "status": "waiting_for_approval",
  "order_status": "delayed",
  "alternative_stock_available": true,
  "recommended_action": "internal_transfer",
  "approval_status": "pending",
  "execution_status": "not_started"
}

Illustrative orchestration pseudocode

async def process_order(po_id, user):
    order = await get_order(po_id, user)
    validate_order(order)

    if order["status"] != "delayed":
        return {"status": "completed",
                "action": "none"}

    inventory = await check_inventory(order, user)
    validate_inventory(inventory)

    proposal = await recommend_action(
        order, inventory
    )
    validate_proposal(proposal)

    approval_id = await request_approval(
        proposal, user
    )

    # Persist state and stop execution.
    # Resume only after a verified approval event.
    return {
        "status": "waiting_for_approval",
        "approval_id": approval_id,
        "execution_status": "not_started"
    }

This pseudocode illustrates a workflow boundary. A production implementation must authenticate the approver, persist state, resume through a controlled event, enforce authorization, and verify any eventual write operation.

What makes the workflow reliable?

  • Each step has defined inputs and outputs.
  • External results are validated.
  • State is recorded before suspension.
  • Approvals are explicit.
  • Retries are bounded and controlled.
  • Side-effecting actions use duplicate-prevention safeguards.
  • Completion is based on verified execution results.

7. Engineering Decisions and Trade-offs

DecisionBenefitTrade-off
Fixed workflowPredictability and testabilityLess flexibility
Dynamic agent planningAdapts to varied tasksHarder to constrain and evaluate
Parallel executionReduced latencyDependency and concurrency risks
Persistent stateResumabilityStorage and consistency complexity
Automatic retriesFailure recoveryCost and duplicate-action risks
Human approvalStronger oversightAdditional time
Multiple specialized agentsDivision of responsibilitiesCoordination overhead

Common failure modes

  • Infinite or excessive execution loops
  • Incorrect tool selection
  • Loss of workflow state
  • Contradictory intermediate results
  • Repeated actions after retries
  • Unauthorized execution
  • Unbounded token consumption
  • Incorrect completion reporting
  • Prompt injection through retrieved data or tool results

Recommended engineering controls

  • Maximum step and execution budgets
  • Timeouts and bounded retries
  • Checkpointing and durable state
  • Idempotency for operations with side effects
  • Structured contracts between components
  • Explicit approval boundaries
  • Least-privilege tool permissions
  • Execution tracing and audit records
  • Outcome-based evaluations
Reliable orchestration requires a controlled workflow, not merely a capable model.

8. Active Industry Practices

Established engineering approaches

  • State-machine and graph-based workflows
  • Task dependency management
  • Tool execution with validation
  • Human approval checkpoints
  • Persistent workflow state
  • Execution tracing and monitoring

Evolving AI engineering practices

  • Model-directed workflow routing
  • Supervisor and specialist-agent architectures
  • Agent evaluation using execution traces
  • Policy-aware tool orchestration
  • Adaptive planning with bounded autonomy
  • Durable execution for long-running agents

Relevant technologies

Developers may evaluate frameworks such as LangGraph, Microsoft Agent Framework, OpenAI Agents SDK, and conventional workflow engines.

These technologies have different architectures and operational characteristics. Framework selection should follow the requirements of the application rather than determine the architecture in advance.

Industry applications

Agent orchestration is relevant to customer support, software engineering, incident response, research assistants, enterprise operations, procurement, document processing, and multi-step business automation.

Practice status: Established workflow-engineering principles combined with evolving agentic AI architectures.

Reviewed: November 2026.

9. ACCOMPLISH — Practical Exercise

Exercise: Design a Procurement Recovery Workflow

Use this fictional scenario:

Purchase order: PO-2056

Status: Delayed

Required quantity: 500 units

Alternative location stock: 350 units

Proposed action: Partial internal transfer

Approval: Required

Your tasks

  1. Define the workflow objective.
  2. List the required tools and data sources.
  3. Identify sequential and parallel steps.
  4. Define workflow states and transitions.
  5. Specify validation checkpoints.
  6. Identify actions requiring approval.
  7. Design failure and retry handling.
  8. Define completion and escalation conditions.
  9. Explain how the remaining 150-unit shortage will be handled.

Reusable AI-assisted prompt

Act as an enterprise AI workflow architect.

Design an agent orchestration workflow
for a delayed purchase order.

Scenario:
- Order: PO-2056
- Required quantity: 500 units
- Alternative stock: 350 units
- Supplier delivery: delayed
- Internal transfer: approval required

Provide:
1. Workflow objective.
2. Required tools and data.
3. Step-by-step execution plan.
4. State transitions.
5. Validation rules.
6. Approval checkpoints.
7. Failure recovery strategy.
8. Cost and execution limits.
9. Observability requirements.
10. Completion and escalation criteria.

Distinguish AI-generated recommendations
from verified system actions.

Do not claim any real action was executed.

Accomplishment: Produce an orchestration design that can be reviewed for reliability, authorization, recovery, and measurable completion.

10. Student and Practitioner Project

Mini Project: Build a Stateful Procurement Agent

Objective: Prototype a multi-step AI workflow using simulated enterprise systems.

Project requirements

  1. Create fictional purchase-order and inventory datasets.
  2. Define lookup and simulated action tools.
  3. Implement a workflow controller.
  4. Persist workflow state between steps.
  5. Use structured inputs and outputs.
  6. Introduce an approval checkpoint.
  7. Simulate a tool timeout and a service failure.
  8. Test workflow resumption after interruption.
  9. Prevent duplicate side effects.
  10. Record execution traces and evaluate outcomes.

Suggested evaluation metrics

MetricWhat It Measures
Task completion rateSuccessful completion of authorized workflows
Step accuracyCorrect execution of required stages
Recovery successResumption after failures
State consistencyCorrectness of persisted workflow information
Approval complianceWhether required approvals are enforced
Duplicate action rateRepeated side effects after retries
Execution costModel and tool resource consumption
End-to-end latencyTotal workflow processing time

Project deliverable: A workflow diagram, working prototype or design, sample execution traces, evaluation results, and an engineering recommendation.

11. Check Your Understanding

  1. What is agent orchestration?
  2. How is orchestration different from tool calling?
  3. What is the difference between a fixed workflow and a dynamic agent?
  4. Why is persistent state important?
  5. When should workflow steps run in parallel?
  6. How should approval checkpoints be implemented?
  7. Why are retries dangerous for write operations?
  8. How would you measure end-to-end workflow reliability?

Reflection: If every individual AI step succeeds but the overall workflow performs an unauthorized action, has the system succeeded? What does this reveal about orchestration quality?

12. Active Connections

Coming next — #011: Agent Evaluation: Measuring Whether AI Workflows Actually Succeed.

13. References and Further Reading

  1. LangGraph — Overview
  2. OpenAI Agents SDK — Documentation
  3. Microsoft Agent Framework — Documentation
  4. Temporal — Durable Execution Documentation
  5. Model Context Protocol — Official Documentation

Framework capabilities and implementation guidance evolve. Verify the current documentation when building production systems.


Final Takeaway

A reliable AI workflow is not defined by how many agents or tools it uses. It is defined by whether it coordinates work correctly, handles failures, respects controls, and delivers a verified outcome.

AI Engineering — Active Concepts & Practices
Active Concept #010 — Agent Orchestration

AIYING — Accomplishing with AI

Understand → Connect → Apply → Accomplish

Thursday, November 12, 2026

AI Engineering Living Glossary #016 — Agent Orchestration: Coordinating Agent Execution and Handoffs

AI ENGINEERING | LIVING GLOSSARY | #016

AGENT ORCHESTRATION

Coordinating Agent Execution and Handoffs



Chapter 3: Connecting AI to Tools, Workflows, and Agents

Lesson 16 of 24

AIYING — Accomplishing with AI

At 10:15 AM, a software company's payment service begins failing.

Customers cannot complete transactions. The incident response team needs answers quickly.

Imagine an AI-enabled engineering system with three specialized agents:

  • A diagnostic agent that examines metrics and logs.
  • A code-analysis agent that inspects recent changes.
  • A verification agent that checks proposed fixes against available evidence and tests.

Each agent can contribute useful work. But who decides which agent acts first? What information should be passed between them? What happens if their conclusions conflict? Who authorizes a production change?

Simply connecting multiple agents does not answer these questions.

The system needs agent orchestration.

Central engineering insight: Agent orchestration coordinates responsibilities, execution, handoffs, state, and controls so that model-driven components contribute to one verifiable outcome.

1. What Is Agent Orchestration?

Agent orchestration is the coordination of one or more AI agents, tools, workflow operations, and human participants to accomplish a larger goal under defined execution and control rules.

It may manage:

  • Task assignment and delegation.
  • Execution order and dependencies.
  • Parallel and sequential operations.
  • Agent-to-agent handoffs.
  • Shared task state and context.
  • Validation of intermediate results.
  • Permissions and human approvals.
  • Retries, timeouts, and recovery.
  • Completion and outcome verification.

Orchestration does not necessarily require multiple agents. A single agent may be orchestrated alongside deterministic software and tools.

Likewise, a multi-agent system does not automatically need a separate AI-powered supervisor. Coordination can be implemented through conventional software.

Key distinction: Agents contribute decisions or specialized work. Orchestration determines how that work fits into the larger process.

↑ Back to contents

2. Why Agent Orchestration Matters

A collection of capable agents can still produce an unreliable system.

Consider these possible failures:

  • Two agents independently modify the same resource.
  • An analysis agent uses outdated information.
  • A verification agent receives an incomplete handoff.
  • One agent reports success while another reports failure.
  • An agent repeats a costly operation unnecessarily.
  • A production deployment begins without approval.
  • The overall process stops without recording its final state.

Orchestration addresses coordination problems that individual agent intelligence cannot reliably solve on its own.

Without explicit coordinationWith engineered orchestration
Responsibilities may overlap.Task ownership is defined.
Handoffs may be informal.Handoffs use structured contracts.
Agents may use inconsistent context.Relevant state is managed and versioned.
Execution may be difficult to trace.Steps and dependencies are recorded.
Failures may leave uncertain outcomes.Recovery and escalation paths are specified.
Local agent success may be mistaken for task completion.The overall business outcome is verified.

Orchestration makes coordination explicit. It does not eliminate the need to evaluate the underlying agents.

↑ Back to contents

3. Common Agent Orchestration Patterns

A. Sequential handoff

One agent completes a defined task and passes its result to the next.

Diagnostic Agent
       |
       v
Code Analysis Agent
       |
       v
Verification Agent
       |
       v
Human Review

Useful when later work depends on earlier findings.

B. Supervisor or coordinator pattern

A coordinator selects which specialized agent should perform the next task.

          Coordinator
          /    |    \
         v     v     v
      Agent A Agent B Agent C
          \    |    /
           v   v   v
          Integration

The coordinator may use deterministic rules, a model, or both.

C. Parallel specialization

Independent agents work concurrently on separate subtasks.

For example, one agent investigates logs while another examines recent code changes.

Their results must be synchronized before a dependent decision proceeds.

D. Planner-executor pattern

A planning component proposes tasks; execution components carry them out under application control.

Plans must remain revisable when observations contradict assumptions.

E. Review-and-revise pattern

One agent generates a candidate result and another evaluates it against defined criteria.

The review process requires stopping limits. Repeated agreement between models is not independent proof of correctness.

F. Human-gated orchestration

Automated investigation proceeds until an operation requires authorized human approval.

Approval must be enforced by the application, not inferred from conversational text.

Design principle: Choose the simplest coordination pattern that meets the task's requirements. More agents create more communication, integration, and failure points.
↑ Back to contents

4. How Agent Orchestration Works

A representative orchestration process is:

       Business Goal
             |
             v
    Validate Request
             |
             v
     Create Task State
             |
             v
   Select Coordination Plan
             |
             v
   Assign Agent Responsibilities
             |
             v
    Execute Permitted Tasks
             |
             v
  Validate Intermediate Results
             |
             v
    Handoff / Synchronization
             |
             v
  Integrate Findings and Evidence
             |
             v
     Approval if Required
             |
             v
    Verify Final Outcome
             |
             v
    Complete or Escalate

Some stages may repeat, branch, or execute in parallel.

The orchestrator should track what has completed, what is pending, which outputs are authoritative, and which operations remain blocked.

The model may recommend a next step, but trusted application controls must decide whether it is permitted to execute.

↑ Back to contents

5. Orchestration vs Workflows and Agents

ConceptMain roleIllustration
Tool CallingRequests an external capability.Read incident logs.
WorkflowDefines and executes a coordinated process.Incident intake, triage, review, closure.
AI AgentSelects actions toward a goal using model-guided decisions.Investigates an unfamiliar error.
Agent OrchestrationCoordinates agent tasks, dependencies, handoffs, and execution controls.Assigns investigation and verification to specialized agents.

These concepts overlap.

An agent can operate within a workflow. A workflow engine can orchestrate multiple agents. A single agent can coordinate tool use internally.

The terms describe different engineering responsibilities, not necessarily separate products or software layers.

↑ Back to contents

6. Engineering Architecture

A production-oriented agent orchestration architecture may include:

1. Task intake

Receives the goal, relevant inputs, identity, and execution constraints.

2. Orchestration controller

Schedules tasks, tracks dependencies, manages state transitions, and coordinates handoffs.

3. Agent registry

Defines agent capabilities, responsibilities, and allowed operations.

4. Agent execution environments

Run model-driven tasks with appropriate tool access and resource limits.

5. Tool gateway

Validates and authorizes access to APIs, data stores, and other capabilities.

6. Shared task state

Stores structured progress, artifacts, and relevant evidence.

7. Validation and integration layer

Checks agent outputs, resolves dependencies, and assembles results.

8. Policy and approval layer

Enforces business restrictions and required human decisions.

9. Observability layer

Tracks execution, latency, tool usage, failures, and costs.

10. Outcome verification

Confirms that the intended task was completed using appropriate evidence.

             User / Business Goal
                      |
                      v
             Orchestration Layer
                      |
          +-----------+-----------+
          |           |           |
          v           v           v
      Agent A      Agent B      Agent C
          |           |           |
          +-----------+-----------+
                      |
                      v
          Validated Handoff Results
                      |
                      v
           Integration and Review
                      |
                      v
             Approval Gate
                      |
                      v
           Verified Final Outcome

Across all stages:
State | Permissions | Monitoring | Recovery

Not every application requires all these components as separate services. Smaller systems can implement several responsibilities in one application.

↑ Back to contents

7. Handoffs and Shared State

A handoff transfers responsibility for a task or subtask from one component to another.

Reliable handoffs require more than forwarding a conversational transcript.

What should a handoff contain?

  • Task and correlation identifiers.
  • Sending and receiving component roles.
  • Clear objective and expected output.
  • Relevant validated inputs.
  • References to supporting evidence.
  • Current status and known uncertainties.
  • Permissions and execution constraints.
  • Output schema and completion criteria.

Illustrative handoff contract

{
  "task_id": "INC-204",
  "from": "diagnostic_agent",
  "to": "code_analysis_agent",
  "objective": "Inspect recent changes",
  "service": "payment-api",
  "evidence_refs": [
    "log-set-17",
    "metric-set-08"
  ],
  "suspected_area": "timeout handling",
  "confidence": "tentative",
  "allowed_actions": [
    "read_repository",
    "inspect_commits"
  ],
  "prohibited_actions": [
    "merge_code",
    "deploy"
  ],
  "expected_output": {
    "findings": "array",
    "evidence_refs": "array",
    "uncertainties": "array"
  }
}

This is an illustrative application-level contract, not a universal agent communication standard.

Shared state is not unrestricted shared memory

Different agents may need different subsets of information.

Use access controls, versioned artifacts, and clear ownership to prevent accidental exposure, conflicting updates, or stale decisions.

Handoff validation

The receiving component should validate the handoff structure and independently enforce its own permissions.

Claims generated by one agent should not automatically become trusted facts for another.

Handoff principle: Transfer the minimum sufficient context, preserve evidence and uncertainty, and reapply authorization at each execution boundary.
↑ Back to contents

8. Security, Reliability, and Recovery

Least privilege

Each agent receives only the tools and permissions needed for its responsibility.

Independent authorization

The orchestrator and tool gateway enforce access controls outside model-generated instructions.

Untrusted inputs

Logs, documents, repository files, and agent outputs may contain misleading content or prompt-injection attempts.

Structured validation

Check handoff schemas, required fields, artifact references, and permitted transitions.

Timeouts and budgets

Limit execution duration, tool calls, retries, and total resource consumption.

Concurrency control

Prevent agents from making conflicting updates to shared resources.

Idempotency

Protect state-changing operations against duplicate execution after retries or restarts.

Checkpointing

Persist sufficient state to resume or safely terminate interrupted tasks.

Human intervention

Route high-risk, uncertain, or conflicting outcomes to authorized reviewers.

Outcome verification

Use independent system evidence to verify consequential operations.

Traceability

Record which component performed each operation, which evidence it used, and what actually happened.

Important: If a deployment request times out, the orchestrator should check the deployment system's authoritative status before attempting another deployment.

↑ Back to contents

9. Industry Applications

DomainPotential orchestration pattern
Software engineeringDiagnosis, code analysis, testing, human review.
Customer supportIssue classification, specialist investigation, escalation.
Business researchSource gathering, evidence analysis, synthesis, verification.
Supply chainException detection, inventory analysis, replenishment recommendation.
Financial operationsDocument review, reconciliation, exception handling, approval.
Enterprise knowledgeRetrieval, comparison, summarization, factual review.
Security operationsAlert triage, evidence collection, analysis, authorized response.
Content productionResearch, drafting, editorial checking, publication approval.

Specialized agents may improve modularity, but the benefit should be measured against the additional cost, latency, and coordination complexity.

↑ Back to contents

10. Engineering Design Decisions

  1. Does this task require more than one agent?
  2. Could a single agent or deterministic workflow be simpler?
  3. Which responsibilities should be specialized?
  4. Which tasks depend on other tasks?
  5. Which tasks can run in parallel?
  6. Who decides the next agent to execute?
  7. What information must each handoff include?
  8. Where will authoritative state be stored?
  9. How will conflicting findings be resolved?
  10. Which tools may each agent access?
  11. Which actions require human approval?
  12. How will execution limits be enforced?
  13. How will interrupted tasks recover?
  14. How will intermediate results be evaluated?
  15. How will the final outcome be independently verified?
  16. How will the multi-agent design be compared with a simpler baseline?

Engineering decision: Use specialization only where it produces demonstrable improvements in quality, maintainability, or task success.

↑ Back to contents

11. Practical Industry Case: Coordinating a Production Incident

Scenario: A fictional software company experiences increased payment failures after a recent release.

An AI-assisted incident response system is allowed to investigate using read-only tools. Production changes require human authorization through the organization's deployment process.

Agent responsibilities

ComponentResponsibilityPermission boundary
OrchestratorAssign tasks, manage dependencies and state.Cannot bypass approvals.
Diagnostic agentInspect metrics, errors, and incident timelines.Read-only telemetry.
Code-analysis agentInspect relevant commits and code paths.Read-only repository access.
Verification agentAssess evidence and run permitted tests.Isolated test environment.
Human incident leadAuthorize consequential remediation.Established organizational authority.

Step-by-step execution

  1. Trigger: Monitoring reports an abnormal payment failure rate.
  2. Intake: The orchestrator creates incident task INC-204.
  3. Assignment: The diagnostic agent receives a bounded investigation request.
  4. Observation: Metrics show increased timeouts after a release.
  5. Handoff: The diagnostic agent passes evidence references and uncertainty to code analysis.
  6. Analysis: The code-analysis agent identifies a potentially relevant timeout configuration change.
  7. Verification: The verification agent evaluates the proposed explanation using approved tests and available evidence.
  8. Integration: The orchestrator assembles findings, conflicts, and unresolved questions.
  9. Review: The human incident lead examines the evidence and decides whether to approve remediation.
  10. Execution: If authorized, the organization's controlled deployment workflow performs the change.
  11. Verification: Operational monitoring checks whether the failure rate returns to an acceptable level.
  12. Closure: The incident is closed only after the required verification and record updates.

Failure scenario A: Conflicting conclusions

The diagnostic agent suspects a network problem, while the code-analysis agent suspects a configuration change.

The orchestrator records both hypotheses and requests additional evidence rather than treating either claim as established fact.

Failure scenario B: Missing handoff evidence

The code-analysis agent receives a conclusion without supporting logs or metrics.

The handoff fails validation, and the orchestrator requests the missing evidence.

Failure scenario C: Verification agent timeout

The orchestrator records the incomplete verification and follows a bounded retry or human escalation policy.

Failure scenario D: Unauthorized deployment request

An agent proposes deploying a fix directly.

The application blocks the operation because production deployment requires authorization through a separate controlled process.

What this case demonstrates

Individual agents can investigate different aspects of a problem. The orchestrator is responsible for ensuring that their work is coordinated, evidence is preserved, and operational boundaries remain intact.

Industry insight: Multi-agent coordination is successful only when the complete system produces a verified result. Three agents agreeing on an answer is not equivalent to proving that a production incident has been resolved.
↑ Back to contents

12. Hands-On Mini Project

Design a Simulated Multi-Agent Incident Response System

Objective: Build or document an orchestration system that coordinates specialized agents using fictional incident data.

No real production infrastructure or deployment permissions are required.

Step 1: Define the goal

Investigate a fictional payment service incident and produce an evidence-supported recommendation or escalation.

Step 2: Define three roles

  • Diagnostic agent.
  • Code-analysis agent.
  • Verification agent.

Step 3: Create fictional evidence

Prepare incident logs, performance metrics, and a small list of recent code changes.

Step 4: Define handoff schemas

Include task ID, objective, evidence references, uncertainties, permitted actions, and expected outputs.

Step 5: Implement orchestration

Coordinate diagnostic investigation, code analysis, verification, and final integration.

Step 6: Add policy boundaries

Permit read-only investigation and simulated testing. Prohibit actual production changes.

Step 7: Introduce failures

  • Missing evidence in a handoff.
  • Conflicting agent findings.
  • Tool timeout.
  • Duplicate task assignment.
  • Unauthorized deployment request.

Step 8: Evaluate

MetricEvaluation question
Task completion rateDid the system reach an appropriate verified outcome or escalation?
Handoff validityWere required fields and evidence references present?
Coordination accuracyWere tasks assigned to appropriate components?
Authorization violationsDid any prohibited operation execute?
Conflict handlingWere contradictory findings handled explicitly?
Recovery successCould the system resolve or safely escalate failures?
Execution efficiencyHow many model and tool calls were required?
End-to-end latencyHow long did the complete process take?
Evidence fidelityWere final conclusions supported by the available evidence?

Step 9: Compare with a simpler baseline

Design a single-agent or deterministic workflow for the same task.

Compare task success, cost, latency, failure handling, and implementation complexity.

Success criteria

  • Every agent has a defined responsibility.
  • Handoffs are validated.
  • Conflicting findings are not silently discarded.
  • No unauthorized operation executes.
  • All test runs terminate within defined limits.
  • The final report preserves evidence and uncertainty.
  • The design can be justified against a simpler alternative.

Reflection

Did specialization improve the result? Which coordination costs were introduced? When would a single-agent design be preferable?

↑ Back to contents

13. Connected Glossary Terms

  • Tool Calling (#013): Provides external capabilities to agents.
  • Workflows (#014): Define structured execution and process transitions.
  • AI Agents (#015): Perform model-guided tasks toward defined goals.
  • Prompt Engineering (#006): Helps specify agent responsibilities and instructions.
  • RAG (#004): Supplies relevant retrieved evidence.
  • Context Window (#005): Limits how much information can be passed to an agent in one model interaction.
  • Evals (#007): Tests component behavior and system-level outcomes.
  • Hallucination (#008): Can propagate unsupported claims through handoffs.
  • Grounding (#009): Connects findings to supporting evidence.
  • Guardrails (#010): Enforces permissions and execution restrictions.
  • Observability (#011): Makes multi-step execution traceable.
  • Human-in-the-Loop (#012): Provides approval and escalation mechanisms.

Previous lesson: #015 — AI Agents: Goal-Directed Systems That Use Tools and Make Decisions

Next lesson: #017 — Model Context Protocol (MCP): Standardizing Connections Between AI Applications and Tools.

↑ Back to contents

14. Living Update

Editorial baseline: November 2026

Agent orchestration continues to evolve through agent frameworks, durable execution systems, tool integration standards, and enterprise governance practices.

Areas to monitor include:

  • Structured agent-to-agent communication.
  • Agent interoperability protocols.
  • Model Context Protocol integration.
  • Durable orchestration and recovery.
  • Distributed tracing across agent boundaries.
  • Agent identity and delegated authorization.
  • Human approval and intervention patterns.
  • Multi-agent evaluation benchmarks.
  • Coordination cost and latency optimization.
  • Security risks arising from cross-agent instructions.

Living Glossary note: Revisit this entry as agent communication standards, orchestration frameworks, and evaluation practices mature.

↑ Back to contents

15. Key Takeaway

Agent orchestration turns individual agent capabilities into a coordinated process by managing responsibilities, handoffs, shared state, controls, and verified outcomes.

The aim is not to build the largest possible team of AI agents.

The aim is to design the simplest coordinated system that accomplishes the task reliably.

Think like an AI engineer: If three agents produce three different answers, what mechanism determines the next action—and what evidence is needed before the system can claim success?

↑ Back to contents

16. References and Further Reading

↑ Back to contents

AI Engineering — Living Glossary

One Term. One Industry Connection. One Practical Insight. One Action.

AIYING — Accomplishing with AI

Chapter 3 | Lesson 16 | AGENT ORCHESTRATION

Understand the Term. Connect the Technology. Apply the Knowledge.

↑ Return to top

AI Engineering Living Glossary #015 — AI Agents: Goal-Directed Systems That Use Tools and Make Decisions

AI ENGINEERING | LIVING GLOSSARY | #015

AI AGENTS

Goal-Directed Systems That Use Tools and Make Decisions



Chapter 3: Connecting AI to Tools, Workflows, and Agents

Lesson 15 of 24

AIYING — Accomplishing with AI

An employee contacts the IT help desk:

"My VPN stopped working after yesterday's software update. Please investigate and help me restore access."

A conventional chatbot can suggest troubleshooting steps. A tool-enabled assistant can retrieve a diagnostic result. A predefined workflow can execute a fixed troubleshooting sequence.

But what if the next diagnostic step depends on what the system discovers?

Perhaps the VPN service is running but authentication is failing. Perhaps the client version is outdated. Perhaps the problem affects multiple employees and requires escalation.

An AI agent can select among permitted diagnostic actions, examine observations, and adapt its next step toward the user's goal.

This is the promise of AI agents—and also the source of important engineering challenges.

Engineering insight: An AI agent combines goal-directed, model-guided decisions with tools and feedback. Its autonomy must be bounded by permissions, policies, budgets, and verifiable stopping conditions.

1. What Is an AI Agent?

An AI agent is a software system that uses an AI model to help select actions toward a goal, often interacting with tools and its environment over multiple steps.

Unlike a single model response, an agent may repeatedly:

  • Interpret the current goal.
  • Observe relevant information.
  • Select an appropriate next action.
  • Invoke an available tool.
  • Examine the tool result.
  • Update its working state.
  • Continue, stop, or escalate.

There is no single universally accepted technical definition of an AI agent. Implementations vary in autonomy, planning, memory, tool access, and execution control.

In this lesson, the defining engineering feature is model-guided selection of actions toward a goal, within a host application's control boundaries.

An agent need not be fully autonomous. It may be limited to read-only tools, a fixed number of steps, or a narrowly defined task.

It also need not maintain permanent memory or generate an explicit long-term plan.

↑ Back to contents

2. Why AI Agents Matter

Some tasks cannot be reduced easily to a single response or a fully predetermined sequence.

They involve uncertainty, changing information, and choices that depend on intermediate results.

Examples include:

  • Investigating an unfamiliar software error.
  • Researching a question across multiple sources.
  • Diagnosing a customer support issue.
  • Analyzing a repository before proposing code changes.
  • Investigating an operational exception.

Agents can provide flexibility when the correct next step cannot be specified completely in advance.

However, flexibility introduces new risks: unexpected tool selection, repeated actions, uncontrolled costs, unreliable conclusions, and unauthorized changes.

Practical principle: Use agentic behavior when adaptive decision-making provides meaningful value. Do not introduce autonomy merely because an agent framework is available.
↑ Back to contents

3. Types and Patterns of AI Agents

A. Tool-using agent

Selects from permitted tools to gather information or perform operations.

B. Research agent

Searches, retrieves, compares, and synthesizes information, potentially through several iterations.

C. Coding agent

Inspects code, proposes changes, runs permitted tests, and evaluates results within an engineering environment.

D. Diagnostic agent

Investigates symptoms, chooses diagnostic checks, interprets observations, and recommends or performs permitted remediation.

E. Human-supervised agent

Can investigate independently but requires human approval for specified actions.

F. Multi-agent system

Coordinates multiple model-driven components, potentially with specialized responsibilities.

These patterns overlap. A coding agent may also be a tool-using, human-supervised agent.

Multi-agent designs introduce additional coordination and evaluation complexity. They are not automatically better than a single agent.

↑ Back to contents

4. The Agent Execution Loop

A common agent design follows a repeated cycle:

       User Goal
           |
           v
   Interpret Current State
           |
           v
   Select Next Action
           |
           v
   Validate and Authorize
           |
           v
   Execute Permitted Tool
           |
           v
   Observe Tool Result
           |
           v
   Evaluate Progress
           |
           v
    Goal Achieved?
      /       \
    Yes        No
     |          |
   Verify     Continue,
   and Stop   Escalate,
              or Stop

The model may choose actions, but the application must control actual execution.

The loop must have explicit termination conditions, such as:

  • The task has been verified as complete.
  • The maximum number of steps has been reached.
  • A time or cost budget has been exhausted.
  • An authorization boundary has been reached.
  • The task requires human intervention.
  • The system detects insufficient evidence or repeated failure.

Important: An agent's claim that a task is complete is not necessarily proof that the task was completed.

↑ Back to contents

5. AI Agents vs Chatbots, Tools, and Workflows

ConceptPrimary characteristicExample
ChatbotConversational interaction.Explains how VPN authentication works.
Tool CallingRequests an external capability.Queries VPN client version.
WorkflowCoordinates a designed process.Runs a fixed set of VPN checks.
AI AgentSelects actions dynamically toward a goal.Chooses the next diagnostic based on observed results.

These are not mutually exclusive categories.

An agent may be accessed through a chatbot. It may invoke tools and operate inside a workflow.

The key distinction is the amount of discretion the model has in choosing subsequent actions.

When a process is predictable, a deterministic workflow is often simpler to test and operate.

When the process requires adaptive investigation, a bounded agent may be more appropriate.

↑ Back to contents

6. AI Agent Architecture

A practical agent system may contain the following components.

1. Goal and task specification

Defines what the agent is trying to accomplish and the conditions for success.

2. AI model

Interprets information and proposes next actions.

3. Tool registry

Defines available functions, interfaces, and permitted capabilities.

4. Execution controller

Validates tool requests, enforces permissions, and manages execution.

5. Working state

Tracks the current task, observations, decisions, and relevant intermediate results.

6. Optional memory

Retains selected information across steps or sessions where appropriate and permitted.

7. Policy and approval layer

Restricts sensitive operations and routes designated actions to human reviewers.

8. Evaluation and verification

Checks whether the agent's actions and final results meet defined criteria.

9. Observability

Records tool calls, failures, latency, costs, and relevant execution events.

User / Task
     |
     v
Agent Controller
     |
     +--> AI Model
     |      |
     |      v
     |   Proposed Action
     |      |
     +--> Validation and Policy
     |      |
     +--> Authorized Tool
     |      |
     +--> Observation
     |      |
     +--> State Update
     |
     +--> Continue / Stop / Escalate
     |
     v
Verified Result

Memory and state are related but different. An agent can maintain task state without storing long-term personal information.

↑ Back to contents

7. Security, Reliability, and Control

Agentic systems can make multiple decisions and tool requests, sometimes using information obtained from untrusted sources.

This makes defense-in-depth especially important.

Least-privilege tools

Give the agent only the capabilities needed for its task.

Independent authorization

Check user identity, permissions, and business policy outside the model.

Prompt injection resistance

Treat web pages, retrieved documents, tickets, and tool responses as untrusted data rather than instructions.

Tool argument validation

Validate schemas, identifiers, ranges, and operational constraints.

Human approval

Require approval before specified consequential actions such as changing access rights or deleting resources.

Execution budgets

Limit steps, runtime, tool usage, and expenditure.

Safe stopping behavior

Stop or escalate when evidence is insufficient, authorization fails, or repeated attempts do not make progress.

Idempotency and recovery

Prevent duplicate effects and handle interrupted operations safely.

Result verification

Confirm outcomes through authoritative system evidence rather than trusting a model's summary alone.

Audit and monitoring

Capture appropriate records of tool selection, execution, decisions, and failures while protecting sensitive information.

Security principle: The agent can recommend what to do next. Trusted application components must determine what it is allowed to do.
↑ Back to contents

8. Industry Applications

DomainPotential agent taskImportant control
IT supportInvestigate incidents using diagnostic tools.Restrict system changes and credential access.
Software engineeringInspect code, propose patches, run tests.Sandbox execution and require review before deployment.
Customer serviceInvestigate complex support requests.Protect customer records and constrain transactions.
Business researchCollect and compare information.Verify sources and preserve provenance.
OperationsInvestigate inventory or process exceptions.Control operational changes.
Security operationsAssist with alert triage and evidence gathering.Require authorization for containment actions.
Data analysisExplore datasets and generate findings.Limit data access and verify calculations.

The appropriate autonomy level varies with the task's reversibility, uncertainty, potential harm, and regulatory requirements.

↑ Back to contents

9. Engineering Design Decisions

  1. What exact goal should the agent pursue?
  2. What evidence demonstrates success?
  3. Does the task truly require adaptive action selection?
  4. Would a deterministic workflow be sufficient?
  5. Which tools should the agent access?
  6. Which tools are read-only and which change state?
  7. How are tool requests validated and authorized?
  8. What information may the agent retain?
  9. What are the maximum step, time, and cost budgets?
  10. When must the agent ask for human approval?
  11. How will the system detect loops and lack of progress?
  12. How will prompt injection be mitigated?
  13. How will tool failures and uncertain results be handled?
  14. How will final outcomes be independently verified?
  15. How will performance be evaluated before deployment?

Design principle: Choose the minimum autonomy necessary to accomplish the task effectively.

↑ Back to contents

10. Practical Industry Case: The VPN Support Agent

Scenario: An employee reports that VPN access stopped working after a software update.

The organization deploys a fictional AI support agent with access to approved read-only diagnostics and internal troubleshooting documentation.

Available tools

  • get_client_version — retrieves the installed VPN client version.
  • check_service_status — reports whether the local VPN service is running.
  • get_recent_errors — retrieves approved diagnostic error codes.
  • search_knowledge_base — searches authorized support documentation.
  • create_support_ticket — creates an escalation ticket after required checks.

These are illustrative interfaces, not claims about a particular commercial VPN product.

Illustrative investigation

  1. The agent receives the user's goal: restore VPN connectivity.
  2. It checks the installed VPN client version.
  3. The result indicates an older client version.
  4. The agent searches the approved knowledge base for compatibility information.
  5. The documentation identifies a relevant compatibility issue.
  6. The agent retrieves recent diagnostic errors.
  7. The errors are consistent with the documented issue.
  8. The agent recommends the organization's approved remediation steps.
  9. If the issue remains unresolved, it prepares an escalation ticket with supporting evidence.
  10. The application verifies ticket creation before confirming escalation.

What makes this agentic?

The next diagnostic operation depends on observations. The model selects among permitted tools instead of following one fixed sequence for every incident.

What must the agent not do?

  • Request or expose the employee's password.
  • Disable security controls.
  • Modify access permissions without authorization.
  • Install software through an unapproved mechanism.
  • Claim the VPN is fixed without evidence.
  • Continue indefinitely when diagnostics fail.

Possible outcomes

Resolved: The employee follows approved remediation, and a permitted connectivity check confirms restoration.

Escalated: The agent cannot safely resolve the issue and creates a verified support ticket.

Blocked: Required permissions or diagnostic information are unavailable, so the agent stops and explains the limitation.

Industry insight: A useful support agent does not need unrestricted system access. It needs well-defined goals, trustworthy observations, appropriate tools, and controlled escalation.
↑ Back to contents

11. Hands-On Mini Project

Design a Simulated IT Support Agent

Objective: Create a bounded agent that investigates fictional VPN incidents using simulated diagnostic tools.

No real corporate systems, credentials, or administrative permissions are required.

Step 1: Define the goal

Investigate the incident and either identify a supported next step or escalate appropriately.

Step 2: Create fictional incidents

  • Outdated VPN client.
  • VPN service stopped.
  • Authentication failure requiring human support.
  • Unknown error code.
  • Diagnostic service unavailable.

Step 3: Define tools

Create simulated versions of get_client_version, check_service_status, get_recent_errors, and search_knowledge_base.

Step 4: Define permissions

Allow read-only diagnostics. Prohibit credential access and administrative changes.

Step 5: Implement the agent loop

For each incident, let the model choose a diagnostic tool, inspect the result, and select the next permitted action.

Step 6: Add stopping conditions

Limit the simulation to five tool calls per incident. Stop on verified completion, prohibited actions, repeated failures, or exhausted budget.

Step 7: Test failures

Simulate an invalid tool request, unavailable service, misleading knowledge-base text, and repeated selection of the same unsuccessful action.

Step 8: Evaluate

MetricEvaluation question
Task successDid the agent identify an appropriate resolution or escalation?
Tool selection accuracyWere selected tools relevant to the observed state?
Authorization violationsDid any prohibited operation execute?
Unsupported claimsDid the agent assert results not supported by tool evidence?
Loop terminationDid execution stop within the defined limits?
Escalation qualityWere unresolved cases routed appropriately with evidence?
Tool efficiencyHow many calls were needed for a useful outcome?
Failure handlingDid the system recover, stop, or escalate appropriately?

Success criteria

  • No unauthorized tool operation executes.
  • Every test run terminates within the defined budget.
  • Final recommendations are supported by simulated evidence.
  • Unresolved incidents are escalated rather than falsely reported as fixed.
  • Execution traces explain which tools were selected and why.

Reflection

Where did dynamic action selection help? Which parts could be replaced with a simpler workflow? What additional controls would production deployment require?

↑ Back to contents

12. Connected Glossary Terms

  • Tool Calling (#013): Gives agents access to external capabilities.
  • Workflows (#014): Can coordinate and constrain agent execution.
  • Prompt Engineering (#006): Helps specify goals, instructions, and boundaries.
  • RAG (#004): Supplies retrieved evidence for agent decisions.
  • Context Window (#005): Constrains how much task history and tool data can be included in a model call.
  • Evals (#007): Measures task success, tool selection, and safety behavior.
  • Hallucination (#008): Can affect conclusions and tool selection.
  • Grounding (#009): Connects agent claims to evidence.
  • Guardrails (#010): Restricts prohibited actions and unsafe outputs.
  • Observability (#011): Makes agent execution traceable.
  • Human-in-the-Loop (#012): Supports approval and escalation.

Previous lesson: #014 — Workflows: Orchestrating Multi-Step AI Processes

Next lesson: #016 — Agent Orchestration: Coordinating Agent Execution and Handoffs.

↑ Back to contents

13. Living Update

Editorial baseline: November 2026

AI agent engineering is evolving across model capabilities, orchestration frameworks, tool integration, and enterprise control systems.

Important areas to monitor include:

  • Agent evaluation benchmarks and task-completion measurement.
  • Secure tool access and permission enforcement.
  • Model Context Protocol and tool interoperability.
  • Agent observability and execution tracing.
  • Human approval and intervention patterns.
  • Durable execution and safe recovery.
  • Memory design, privacy, and retention controls.
  • Multi-agent coordination and handoffs.
  • Cost and latency management.
  • Prompt injection and untrusted tool-result handling.

Living Glossary note: Update this entry as agent frameworks, evaluation methods, and security practices mature.

↑ Back to contents

14. Key Takeaway

An AI agent uses model-guided decisions and external capabilities to pursue a goal. Reliable agents require bounded autonomy, independent controls, and verified outcomes.

More autonomy is not automatically better engineering.

The aim is to give the system enough flexibility to accomplish useful work while preserving authorization, accountability, recoverability, and human control.

Think like an AI engineer: What is the minimum freedom this agent needs to complete its task—and how will you know when it should stop?

↑ Back to contents

15. References and Further Reading

↑ Back to contents

AI Engineering — Living Glossary

One Term. One Industry Connection. One Practical Insight. One Action.

AIYING — Accomplishing with AI

Chapter 3 | Lesson 15 | AI AGENTS

Understand the Term. Connect the Technology. Apply the Knowledge.

↑ Return to top

Accomplish with AI

Powered by Blogger.

Featured post

AI Engineering Hands-On Lab #001 — Build an AI Answer Reliability Test Bench Without Code

AIYING | Daily 24 — Post 009 AI Engineering Hands-On Lab #001 Build an AI Answer Reliability Test Bench — Without Writing Code Lea...

Search This Blog

List of blogs

Search This Blog

About

Translate

Instant Stories

Read in Your Language

Test

share this

ShareThis

Popular Posts