To build an AI agent, you scope a single task, connect an LLM to a small set of tools it can call, run it in a reason–act loop, and wrap that loop in guardrails so it cannot do anything you haven't allowed. The model is the easy part. What separates a weekend demo from a production agent is everything around the loop: tool design, policy enforcement, cost control, adversarial testing, and an audit trail. This guide walks through all seven steps with working code.
An AI agent is an LLM-powered program that pursues a goal by reasoning in a loop: read context → decide an action → call a tool → observe the result → repeat until done. Three components define every agent:
The difference from a chatbot is consequential: a chatbot produces text; an agent takes actions in external systems — sends emails, writes to databases, issues refunds. That is also why the security and governance steps below are not optional extras.
Every guide from OpenAI's practical guide to Microsoft's agent curriculum converges on the same advice: start with one repetitive, well-bounded task with clear success criteria. Good first agents:
Bad first agent: "an assistant that handles anything our customers ask." Broad scope multiplies the tool surface, the failure modes, and the attack surface all at once.
The honest decision table:
A minimal no-framework agent, for reference — this is genuinely all an agent is:
# A minimal tool-calling agent loop (Python, OpenAI API)
import json
from openai import OpenAI
client = OpenAI()
def search_orders(customer_email: str) -> str:
... # your real lookup
return json.dumps({"orders": [{"id": "A-1042", "status": "shipped"}]})
TOOLS = [{
"type": "function",
"function": {
"name": "search_orders",
"description": "Look up a customer's orders by email.",
"parameters": {
"type": "object",
"properties": {"customer_email": {"type": "string"}},
"required": ["customer_email"],
},
},
}]
messages = [
{"role": "system", "content": "You are a support agent. Use tools; never guess order data."},
{"role": "user", "content": "Where is my order? I'm jane@example.com"},
]
while True:
resp = client.chat.completions.create(model="gpt-4o-mini", messages=messages, tools=TOOLS)
msg = resp.choices[0].message
if not msg.tool_calls:
print(msg.content) # final answer
break
messages.append(msg)
for call in msg.tool_calls:
result = search_orders(**json.loads(call.function.arguments))
messages.append({"role": "tool", "tool_call_id": call.id, "content": result})The model decides what to do; tools define what it can do. Rules that hold up in production:
refund_order(order_id, amount_cents) with a server-side maximum beats run_sql(query) every time.The moment your agent reads input you don't control (customer messages, web pages, retrieved documents), it is exposed to prompt injection: instructions embedded in data that try to redirect the agent. Guardrails that matter:
The architectural point most teams get wrong: guardrails must run synchronously, in the request path. A dashboard that flags a violation five minutes after the refund was issued is observability, not enforcement.
Guardrails protect a single call. Governance manages the agent as an operating entity: who owns it, what autonomy it has, what it spends, and what evidence exists for every action. Concretely, before the agent touches production you want:
This is the layer Execlave provides. Wiring it into the agent from Step 2 is one SDK call — a callback handler for LangChain, a trace processor for the OpenAI Agents SDK:
# LangChain
from execlave import Execlave
from execlave.integrations.langchain import ExeclaveCallbackHandler
exe = Execlave(api_key=os.environ["EXECLAVE_API_KEY"])
handler = ExeclaveCallbackHandler(exe, agent_id="support-bot")
chain.invoke(input, config={"callbacks": [handler]})
# OpenAI Agents SDK
from execlave.integrations.openai_agents import ExeclaveTracingProcessor
add_trace_processor(ExeclaveTracingProcessor(exe, agent_id="support-bot"))Policy evaluation adds microseconds in-process and low single-digit milliseconds server-side (published, reproducible benchmarks) — small enough to sit in the request path of a customer-facing agent. The full ten-minute walkthrough is in Governing LangChain agents in 10 minutes.
Functional tests prove the agent works. Adversarial tests prove it fails safely:
Production day-one requirements:
For what the finished system looks like — two governed agents, the policy set, autonomy tiers, measured enforcement latency, and SIEM routing — see the reference deployment.
No. A minimal agent is a loop around an LLM API with function calling — under 100 lines. Frameworks earn their place when you need orchestration, memory, retrieval, or multi-agent coordination.
Three layers: narrow tools (it can't call what it isn't given), synchronous policy enforcement (allowlists, caps, scanning before execution), and human approval for irreversible actions.
Token spend dominates and scales with loop length — a retry loop can burn hundreds of dollars in minutes. Hard budget caps with automatic cut-off are the only reliable control.
When it passes adversarial testing, has a declared autonomy level with enforced controls, emits a complete audit trail, respects budget caps, and can be paused remotely. Anything less is a demo.
Free tier includes 1 agent, 500 traces/month, and 30-day retention. No credit card required.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。