“Agent” is a design description, not a promise of intelligence. A useful working definition is: a system in which a model can inspect state, choose from bounded actions, observe results, and repeat toward an explicit goal under stop conditions. A chatbot that returns one answer may use AI, but it is not necessarily operating an action loop.
After this lesson, you can specify an agent without vague autonomy claims and decide whether a simpler deterministic workflow is safer.
Identify the Loop
Write six parts:
Goal: observable completion condition
State: facts the run may read and update
Policy: instructions, constraints, and allowed decisions
Tools: typed actions with explicit permissions
Evaluator: checks outcome and risk
Stop: success, budget, timeout, repeated failure, or human review
The model proposes; tools create effects. A tool that only searches a read-only knowledge base has a smaller risk boundary than one that sends money, deletes data, publishes content, or messages a customer.
Use an Autonomy Ladder
- Suggest: model drafts; human performs the action.
- Prepare: model creates an artifact or queued change; human approves.
- Execute reversible: system takes bounded, recoverable actions and logs them.
- Execute consequential: system can affect people, money, access, or public state.
Climb only when evidence justifies it. The same workflow can mix levels: an agent may read support tickets automatically, draft replies, but require approval to issue refunds.
Prefer Determinism Where It Works
Use ordinary code for known transformations, validation, calculations, state transitions, authorization, and financial checks. Use a model where language interpretation or open-ended planning adds value. Wrap model output in schemas and policy gates before any effect.
Worked Example
A Pakistani ecommerce shop wants to “autonomously resolve returns.” The safe first version has a narrower goal: classify a customer’s request, retrieve the order, draft an answer, and prepare a return case.
State includes order reference, delivery status, published return terms, and prior actions. Read tools retrieve the order and policy. The model may select a reason code and draft a response. It cannot mark a refund paid. The evaluator checks the order exists, reason is supported, no sensitive information is echoed, and the correct team owns the case. Stop occurs on prepared case, missing evidence, two failed tool calls, five turns, or human request.
Failure Cases to Diagnose
- Goal is “help the business”: define one observable outcome.
- Model text is treated as authority: validate against source systems.
- No stop condition: cap turns, time, spend, and repeated actions.
- Agent gets administrator access for convenience: scope each tool to the task.
- Success means “no error”: evaluate business correctness and side effects.
- A workflow is called autonomous for marketing: state the real approval points.
- Deterministic logic delegated to a model: keep calculations and authorization in code.
🇵🇰 Pakistan Angle
Start with tasks such as classifying public enquiries, preparing proposals from approved facts, or reconciling non-sensitive records. Do not let a first agent submit FBR filings, change bank details, approve loans, send bulk WhatsApp campaigns, or make employment decisions without qualified human control and legal review.
Design for connectivity and service outages. A tool timeout should create a recoverable state and honest delay, not repeated charges or duplicate customer messages. Store PKR amounts as exact minor-unit integers where the payment system requires it and verify every financial transition outside model reasoning.
Hands-On Exercise
- Pick one real or sample business task.
- Specify goal, state, policy, tools, evaluator, and stop.
- Put each action on the autonomy ladder.
- Replace two model decisions with deterministic checks.
- Write five failure tests and the human route.
Done means: another builder can explain exactly what loops, what can change, how success is checked, and where the system must stop.
Completion Rubric
- The goal has an observable completion condition.
- Tools and state have explicit boundaries.
- Consequential actions require proportionate approval.
- Deterministic rules remain outside the model.
- Budgets and failure stops are testable.
- Success includes correctness and side-effect review.
Sources
Key takeaway: an agent is a bounded action loop with state, tools, evaluation, and stops; autonomy is a permission decision earned by evidence, not a product label.