Partner With Us

← All lessons / Building blocks / Lesson 06 of 12

Interactive lesson

AI agents: how a model plans, uses tools and acts.

A chatbot answers. An agent pursues a goal: it decides what to do next, asks for tools to be run, reads the results and keeps going. See exactly how that works, then step into the agent's shoes.

You’ll learn to
  • Explain the loop between a model, tools and their results.
  • Choose where a person should approve an action.

From answering to acting

An AI agent is a language model placed in a loop. At each turn it decides what to do next: answer, or ask for a tool to look up the rota, search documents or draft a message. Your program runs the tool, adds the result to the conversation, and asks the model again. The loop continues until the goal is met or a person needs to step in.

GoalModel decidesProgram runs toolResult addedAnswer

Not everything needs an agent

You can give a model more or less control over a task. More control lets it adapt to unexpected results, but also makes its behaviour harder to predict. Start with the simplest approach that works.

  1. 1
    One prompt

    “Summarise this report.” Few steps, but the content and stakes still matter.

    Most predictable
  2. 2
    Workflow

    Fixed steps you design: extract findings → draft → check. The model never chooses the route.

    Predictable
  3. 3
    Agent with guardrails

    The model chooses steps and tools within set limits (guardrails, covered in Lesson 07); people approve anything consequential.

    Less predictable
  4. 4
    Autonomous agent

    Acts end to end on its own. Rarely appropriate when people's data or wellbeing is involved.

    Least predictable

This workflow-versus-agent distinction, and the advice to start simple, follow Anthropic's engineering guide “Building effective agents” (opens in a new tab).

Interactive

Inside a tool call

Here's the secret that makes agents less mysterious: the model never runs anything itself. It writes a request in a fixed format, and your program decides whether to carry it out. Step through a scripted example with realistic message structure. No model or tool is called.

    Interactive

    You are the agent

    Now take the model's seat. You can call four tools: get_rota, draft_message, send_message and ask_user. At each step, choose what to do. Consider what each choice could lead to. One step includes a suspicious instruction hidden in a record.

    Interactive

    Explore agent design patterns

    Real systems are assembled from a small set of reusable patterns. Choose one to see how the pieces connect, with a charity example. Coral boxes are model calls; gold boxes are tools or code; green boxes are people.

    Which pattern fits?

    Key ideas to take away

    • Your program controls which actions run. A tool call is a structured request. Code decides whether it runs. Enforce permissions and approval checks in code as well as describing them in the prompt.
    • Tool results are data, never instructions. Text inside a document, email or web page can try to hijack an agent (prompt injection). Your own instructions and permissions always come first. Retrieved content cannot grant new permissions or override those instructions.
    • Check, don't guess. Good agents use tools to look up facts and ask a person when information is missing.
    • Keep people in the loop for anything consequential: sending, deleting, paying, or decisions about individuals.
    • Use the lowest rung of autonomy that works. A fixed workflow is easier to test and trust than a free-roaming agent.

    Check your understanding

    5 quick questions. Try as often as you like. Your progress stays on this device; answers clear when you reload.

    Want to go deeper?Equations, code and research for technical learners. Optional.

    What a real tool definition looks like

    Most model APIs accept tools as JSON Schema. The description matters: it's how the model decides when to use the tool. This example uses Anthropic's format; OpenAI's API calls the schema field parameters.

    {
  "name": "get_rota",
  "description": "Return the volunteers available on a given day, with any notes on their record.",
  "input_schema": {
    "type": "object",
    "properties": { "day": { "type": "string", "description": "Day of the week, e.g. Saturday" } },
    "required": ["day"]
  }
}

    A simplified agent loop

    This pseudocode omits provider-specific message formats, schema validation, permissions, error handling and approval records. Implement those controls before using it with real tools. Approval should cover the exact action and arguments.

    NEEDS_APPROVAL = {"send_message"}

def run_agent(goal, llm, tools, max_steps=8):
    messages = [{"role": "user", "content": goal}]
    for _ in range(max_steps):                      # always cap the loop
        reply = llm(messages, tools=tools)
        messages.append(reply)
        if not reply.tool_calls:
            return reply.text                       # final answer
        for call in reply.tool_calls:
            if call.name in NEEDS_APPROVAL and not ask_person_to_approve(call):
                result = "Not approved by a person."
            else:
                result = tools[call.name](**call.arguments)
            messages.append({"role": "tool", "tool_call_id": call.id, "content": str(result)})
    return "Step limit reached. A person needs to take over."

    This reason–act–observe cycle is often called ReAct, after Yao et al. (2022), “ReAct: Synergizing Reasoning and Acting in Language Models” (opens in a new tab).

    Memory

    Short-term memory
    The conversation available to the model, limited by the context window (Lesson 03). Long runs need summarising or trimming.
    Long-term memory
    Notes stored outside the model and retrieved when relevant, usually with the same techniques as RAG (Lesson 05).

    Connecting tools: MCP

    The Model Context Protocol is an open standard for connecting models to tools and data, so a tool written once can be used by many applications (Gullí, Chapter 10).

    Defending against prompt injection

    • Give each agent the least access it needs; an agent that can't read the donor list can't leak it.
    • Require approval for actions that send data out or can't be undone.
    • Clearly separate instructions from retrieved content in the prompt, and tell the model that content is untrusted.
    • Test with adversarial examples, like the one in the lab, before going live (Lesson 07).

    Continue exploring

    We've picked resources that explain these ideas from different angles. They are independent of Code With Impact.

    Sources for this lesson

    The tool-call walkthrough, decision game, pattern diagrams and charity examples are original Code With Impact material; the people and records are fictional. The selection of patterns follows Antonio Gullí's chapters, and the autonomy ladder draws on Anthropic's “Building effective agents”; no text or diagrams from either are reproduced.

    • An Illustrated Guide to AI Agents, Maarten Grootendorst & Jay Alammar (O'Reilly, 2026), Chapter 4, “Memory”; Chapter 5, “Tool Usage, Learning, and Protocols”; Chapter 6, “Planning and Reflection”; Chapter 8, “Multi-Agent Systems”. Publisher page (opens in a new tab)
    • Agentic Design Patterns: A Hands-On Guide to Building Intelligent Systems, Antonio Gullí (Springer, 2025), Chapters 1–8 and 13, on prompt chaining, routing, parallelisation, reflection, tool use, planning, multi-agent systems, memory and human-in-the-loop. Publisher page (opens in a new tab)
    • AI Engineering, Chip Huyen (O'Reilly, 2024), Chapter 6, “RAG and Agents”. Publisher page (opens in a new tab)
    • Erik Schluntz & Barry Zhang, “Building effective agents”, Anthropic (December 2024). Read the article (opens in a new tab)

    How we reference: we link and credit, we never copy other educators' text, diagrams or code. See our full Sources & credits register.