Back to the topic overview

Bounded AI systems

Agentic Engineering

An AI agent works through a task in several steps. It checks the current state, chooses an action, uses a tool, reads the result, and decides what to do next. A chatbot often gives one answer and stops.

Agentic Engineering is the work of making that loop useful and controlled. The field is new. Terms vary, capabilities change quickly, and no standard design makes an agent safe or reliable by default.

The core idea

A practical agent combines a model, instructions, tools, working state, and a loop. Its tools may read code, query a database, open a ticket, or propose a change. Memory can keep useful context. Policy limits what the agent can see and do.

A model can give a clear explanation and still be wrong. Important actions therefore need normal controls: identity, limited permissions, validated inputs, logs, budgets, stop conditions, and human approval when the impact is high.

How an agentic workflow works

The exact loop differs between systems, but a controlled workflow usually contains the following stages.

  1. 01 · Scope the task

    A person or trusted system states the goal, boundaries, available data, success criteria, and actions that are forbidden or require approval.

  2. 02 · Form a plan

    The agent breaks the task into steps. The plan is provisional: new evidence may require revision, and a reviewer should be able to inspect the intended direction.

  3. 03 · Select a tool

    The system chooses from an allowlist of tools with structured parameters. It should not gain a general-purpose credential simply because one tool needs narrow access.

  4. 04 · Check permission

    Policy evaluates identity, task context, data sensitivity, action impact, and budget. A high-impact action pauses at an approval gate.

  5. 05 · Act and observe

    The tool performs the bounded operation and returns a result. The agent records what happened, validates the response, and uses it as new evidence rather than unquestioned truth.

  6. 06 · Stop or escalate

    The loop ends when success criteria are met, a limit is reached, uncertainty becomes too high, or a person must decide. A safe agent is designed to stop, not only to continue.

Where it is used

Agentic systems are most credible when they operate in a defined environment with measurable outcomes and limited consequences.

Software engineering

Inspecting a repository, proposing a small change, running tests in a sandbox, and presenting the diff for human review.

Operations support

Collecting diagnostic information, correlating recent changes, and drafting a remediation plan without directly altering production.

Research workflows

Searching approved sources, extracting evidence, comparing claims, and producing a traceable draft that a researcher can verify.

Administrative processes

Preparing a ticket, routing a request, or assembling a report where each external action is logged and sensitive decisions remain with people.

What it can improve

Agents can reduce the coordination cost of multi-step work, especially when information is spread across several tools.

  • Carry context across several steps instead of restarting with every tool.
  • Automate repetitive collection and preparation work around expert decisions.
  • Apply a documented workflow more consistently when the environment is well bounded.
  • Create useful action trails when tool calls, inputs, outputs, and approvals are recorded.

Risks and limitations

Tools turn a wrong answer into a possible wrong action. Controls need regular testing because agent behavior and guidance continue to change.

Goal or instruction hijacking

Untrusted text in a document, website, issue, or tool result may try to redirect the agent away from the authorized task.

Excessive agency

A tool may expose more data or authority than the task requires. A small planning error can then have a large operational impact.

Cascading errors

One plausible but wrong observation can shape the next plan, tool choice, and action, making a multi-step failure harder to notice.

Memory poisoning

Incorrect or malicious information stored as memory can influence later tasks, users, or decisions long after the original input disappeared.

Poor observability

If prompts, tool calls, policy decisions, and state changes are not recorded, operators cannot reconstruct why an action occurred.

Runaway loops and cost

An agent can repeat unsuccessful actions, consume resources, or create load. Time, action, and spending budgets need hard limits.

Human responsibility

People choose the goal, tools, permissions, evaluation criteria, and approval rules. These are governance decisions. A prompt should not decide them.

Oversight also has to be realistic. Asking someone to approve hundreds of unclear actions is not useful control. Reviewers need enough context, time, and authority to say no.

  • Set task boundaries and least-privilege access
  • Approve consequential or irreversible actions
  • Review logs, evaluations, and failure patterns
  • Suspend the system and investigate incidents

Key takeaways

  • 01An agent connects a model to a loop of observation, action, tools, and feedback.
  • 02Useful autonomy needs limited permissions, validation, logs, budgets, and stop conditions.
  • 03A strong demo does not prove reliable behavior in real work.
  • 04People remain responsible for goals, access, approvals, and incidents.

Sources and further reading

A compact selection of primary sources, standards, and public technical guidance used to ground this article.