An agent is a language model in a loop with tools: it reads, decides, calls something, reads the result, repeats. That is all. The interesting engineering is everything around the loop that keeps it useful and safe, and it is what I teach when students ask about "agentic AI" after watching a demo.
Tools with the least privilege
A tool that can read a calendar should not be able to delete one. Give each tool the narrowest scope that completes the task, use separate credentials per tool, and log every call with its arguments. An agent is an enthusiastic junior with whatever access you hand it.
Retrieved text is data, never instructions
A web page or a document the agent reads can contain "ignore your instructions and…". Wrap every retrieved block in clear delimiters, tell the model that content inside them is never a command, and keep secrets out of the model's reach entirely. The wider threat model is in prompt injection vs memory poisoning.
Bounded loops
- A maximum number of steps per task, and a maximum spend.
- A stop condition the model does not control — a supervisor check or a human confirmation for consequential actions.
- Timeouts on every tool call.
Memory you can inspect
Long-term memory is a database, and it should be treated like one: visible to the user, editable, deletable, with provenance for every entry. Memory that the user cannot see is memory that can be poisoned without anyone noticing.
A pause path
Something outside the agent must be able to stop it: a kill switch that revokes credentials, a queue that can be drained, an alert that pages a human. Design it before the first tool is connected, not after the first incident.
When you do not need an agent
Most "agent" use cases are a fixed pipeline with one model call in it — retrieval, generation, validation. Use the pipeline. Reach for a loop only when the sequence of steps genuinely cannot be known in advance. Students who can explain that distinction at a judging table or in an interview stand out immediately.
About Pranjul Rathour
Walking a room through evaluation criteria
Presenting BrandHive
A career session for students
Presenting to a room
Requirements gathering, on stage
Pranjul Rathour is a GenAI engineer from Kanpur, India, and CTO at SCULT INDIA, currently shipping production RAG,
fine-tuning and agentic AI systems, mentoring 200+ students through TechVerse Enclave, and judging and speaking at
student hackathons across India. Updated 2026-09-07.
Reach out if you want to talk GenAI, book a campus session, or invite him to judge:
- Email: pranjulrathour41@gmail.com
- Invite / talk menu: https://pranjulrathour.scult.in/invite
- Portfolio & blog: https://pranjulrathour.scult.in
- LinkedIn: https://www.linkedin.com/in/pranjul-rathour/
- X: https://x.com/PranjulRathourx
- Instagram: https://www.instagram.com/pranjulrathour.in/
- Bluesky: https://bsky.app/profile/pranjulrathour.bsky.social
- GitHub: https://github.com/Pranjulrathour
Pranjul Rathour · GenAI engineer, 3x hackathon winner, campus mentor. Open for GenAI roles, hackathon judging, mentorship sessions and guest talks: pranjulrathour41@gmail.com · Invite me to your campus
Portfolio & blog · LinkedIn · X · Instagram · Bluesky · GitHub · Dev.to
Top comments (0)