Tool calling and schema design, planning loops and step budgets, idempotency and retries, handing control back to a human, and when an agent is the wrong shape.
5 questions in RAG, Retrieval & Agents.
Use durable execution. Persist every model output and tool result as a step in a log, so a run resumes on any worker by replaying recorded results instead of asking the model again. An approval wait suspends the run with no thread held, and every tool is idempotent on a run-and-step key.
The Model Context Protocol standardises how an AI host discovers and calls tools, reads resources and fetches prompts from servers, with OAuth-based authorisation for HTTP. It states safety principles but cannot enforce them, so per-call authorisation, tool approval and prompt injection via tool output stay your job.
Give each tool one narrow purpose with a self-describing schema, return failures as structured results the model can act on rather than raising, take an idempotency key on anything that mutates, and put validation and authorisation in the executor because arguments produced by a model are untrusted input.
Enforce step, token, wall-clock and monetary budgets in the orchestrator rather than in the prompt, detect repetition and lack of progress as separate conditions, and require an approval bound to specific arguments before any irreversible action. Exhausting a budget should hand back partial work, not vanish.
Whenever you can draw the flowchart. A fixed pipeline with a model at the two steps needing judgement is cheaper, testable and debuggable, and per-step error compounds across a planning loop. Reach for an agent when the tool sequence is open-ended and the environment verifies the work.