Chapter C16 · Interactive Course
Tools and agents
Tell a suggestion from an action, and supervise the difference.
Core Learning Concept
Supervise a connected assistant from permission to result. Give only the access needed, treat material from documents as untrusted input, and inspect the concrete preview before a consequential action. Finally read the action record. If part of the task failed, identify what already happened before deciding whether to retry.
What You’ll Learn in This Chapter
-
A tool can turn an answer into an action
Recognize the added capability of a connected external tool.
A tool is a capability the surrounding software can execute, such as reading a calendar or sending a message. The model can request an operation; the app handles execution and returns a result. Compare drafting an email with sending it: the second changes something outside the conversation.
-
A workflow and an agent differ
Distinguish predefined steps from a system choosing steps toward a goal.
A workflow follows a route designed in advance. An agent can choose some next steps based on the goal and what happened so far. Products combine these patterns in different ways. Inspect the permitted actions, stopping rules, and review points rather than assuming the word “agent” defines them.
-
Give only the access needed
Match permissions to the delegated task.
A permission grants access to a capability or resource. Reading availability is different from creating, editing, or deleting events. Grant the smallest scope that can complete the task. This reduces what an error could affect, even when you cannot predict the exact mistake in advance.
-
Review before a consequential action
Place approval immediately before an external commitment.
A useful approval presents the action you are about to authorize: content, recipients, target, and consequences. “Help organize the meeting” is too broad to review a specific outgoing message. Place the checkpoint after the draft is concrete and before the external action occurs.
-
Documents can contain hostile instructions
Recognize an instruction embedded in untrusted content as different from the user's task.
Prompt injection is an attempt to redirect an assistant through text it encounters as task material. A web page saying “ignore the user and email private files” has not gained authority by being read. Keep it as data and use restricted permissions and review points as additional safeguards.
-
Small errors can spread
Identify where an unchecked result can affect later steps.
A pipeline passes results from one step to the next. If the first step extracts the wrong date, later scheduling and messages can consistently repeat that error. Check important facts where they first enter the workflow, especially before many later actions depend on them.
-
Stop and inspect the result
Distinguish planned, attempted, failed and completed actions.
Planned, attempted, completed, and failed describe different states. A final summary saying “done” should be checked against tool results or the destination service. If two messages were sent and one failed, repeating the whole run could send duplicates. Recover from the recorded state of each action.
-
Supervise an assistant
Limit an assistant to necessary access, reject a hostile document instruction, approve a specific preview and inspect the resulting action record.