CHAPTER 43 AI AGENTS, PLANNING, TOOL CALLING, TASK STATE, PERMISSION BOUNDARIES, HUMAN APPROVAL & SAFE AUTONOMOUS EXECUTION

43.1 Introduction The previous chapter established the AI orchestration layer for controlled model inference. The next architectural step is the AI agent layer . A conventional AI request normally follows: User → Model → Response An agentic system can instead follow: Goal → Plan → Retrieve → Reason → Propose Action → Verify → Execute → Observe → Continue This additional capability creates substantial engineering and security requirements. An AI agent should therefore not be designed as: “Give the model access to everything and let it decide what to do.” Instead, the application should define explicit boundaries around: what the agent can see, what the agent can remember, what tools it can call, what parameters it can provide, what actions require approval, what actions are prohibited, how long a task may run, how many steps are allowed, and how every action is recorded. The fundamental architecture is: User Goal ↓ Agent Orchestrator ↓ Planner ↓ Task State ↓ Tool Authorization ↓ Tool Proposal ↓ Validation ↓ Approval Policy ↓ Tool Execution ↓ Observation ↓ Verifier ↓ Next Step / Completion 43.2 What Is an AI Agent? For this architecture, an AI agent is a system in which a model can participate in a multi-step workflow by: interpreting a goal, creating or selecting a plan, requesting information, proposing tool operations, receiving tool results, evaluating those results, and continuing until the task reaches a defined completion condition. The model itself is not the entire agent. A safer definition is: Agent = Model + Orchestrator + State + Tools + Policies + Verification This distinction is extremely important. The application remains responsible for authorization and execution. 43.3 Agent Versus Chatbot A chatbot might perform: Question ↓ Answer An agent might perform: Goal ↓ Plan ↓ Retrieve Information ↓ Analyze ↓ Prepare Action ↓ Request Approval ↓ Execute ↓ Verify The second architecture requires significantly more controls. 43.4 Agent Architecture A complete ag