THE SHORT ANSWER
An agent usually includes a model, instructions, context, tools and a loop controller. It may also use working state, persistent memory and external data. Permissions limit actions; verification checks results; stopping rules decide when to finish, fail or ask a person. The architecture matters more than the product label.
The decision core
| Component | Role | Design question |
|---|---|---|
| Model | Interprets and proposes | Does it meet this task's quality threshold? |
| Instructions | Define role, rules and priorities | Which rules must software enforce too? |
| Context | Supplies current information | What is relevant for this step? |
| Control logic | Runs the loop and routes outcomes | When can the model choose, and when can it not? |
Instructions can guide a model, but a sentence such as ‘never send without approval’ should not be the only barrier. Consequential rules belong in the surrounding application, where they can be enforced consistently.
The action boundary
Tools expose named capabilities such as searching, reading a record or drafting a message. The environment is the world those tools touch: a browser, file system, database, calendar or business service. Permissions determine which identities, records and operations are reachable.
Tool definitions should communicate inputs, outputs, side effects and errors. The host should validate arguments, authenticate the request and return a trustworthy observation. Tools and function calling examines this boundary in detail.
Evidence & context: OpenAI Developers · Model Context Protocol
Context, state and memory are different
Context is what the model can consider now. Working state records progress, such as which invoice was checked. Persistent memory stores information for later sessions. External data remains in source systems. Mixing these concepts encourages stale facts, uncontrolled retention and excessive context.
A state record should include provenance and status: proposed, approved, executed or failed. A generated sentence claiming ‘sent’ is not evidence that a message left the system.
Verification and stopping complete the anatomy
- Verify tool outcomes against the environment, not only the model's narration.
- Stop on success, a hard limit, a policy boundary, missing information or human escalation.
- Record attempts and external actions for diagnosis and audit.
- Design recovery for partial success, including idempotency and rollback where possible.
Evidence & context: NIST
Sources & further reading
- Building effective agents
Anthropic. A provider's engineering taxonomy of agents and workflows, not a universal industry definition. We use the conceptual distinction, not its changing product recommendations.
- Using tools
OpenAI Developers. Official documentation showing how models can be given built-in, function and remote tools. Checked 13 September 2026; product-specific tool names and availability can change.
- Model Context Protocol architecture
Model Context Protocol. The official protocol architecture checked 13 September 2026. It describes hosts, clients, servers and capability negotiation; it does not make every connected tool safe or appropriate.
- Generative Artificial Intelligence Profile (NIST AI 600-1)
NIST. Risk-management guidance, including confabulation. It does not establish a universal error rate.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗