A chatbot generates text. An agent can choose and invoke tools that read data or change the world. That additional capability changes the architecture and the risk model.
Separate reasoning from execution
Let the model propose a structured action with a known tool name and validated arguments. Deterministic application code should authenticate the user, validate the schema, check permissions and policy, execute the action, and return a structured result.
Do not give the model raw cloud credentials or an unrestricted shell. The tool boundary is where intent becomes authority.
Keep tools small and explicit
A tool named restart_service with a service identifier and environment is easier to validate than a generic tool named run_command. Narrow tools improve safety, evaluation, auditability, and error handling.
Assign each tool a dedicated IAM role or tightly scoped permission path. Apply tenant and resource authorization in code even if the model already mentioned the correct tenant.
Choose an orchestration model
A short conversational turn can run synchronously behind API Gateway and Lambda. A long-running job with retries, human approval, or waiting fits a durable workflow such as Step Functions or another persisted state machine. Queues help isolate bursty tool work.
Persist the business state, not hidden model thoughts. Record messages, tool proposals, approvals, executions, results, model and prompt versions, and user-visible errors.
Add retrieval only when it improves the decision
RAG can supply policies, manuals, architecture context, or customer documents. Retrieval must preserve authorization and source citations. The AWS RAG assistant architecture provides a grounded starting point.
Require approval for consequential actions
Creating infrastructure, changing production, sending external messages, spending money, and deleting data deserve clear confirmation or policy-based approval. Show the user what will happen, the target, and the important parameters before execution.
Idempotency keys prevent repeated approvals or retries from running the same action twice. Compensation or rollback behavior should be part of each tool's design.
Treat model failure honestly
Models can return malformed output, unsupported actions, incomplete arguments, or confident text without a valid action. Render useful explanation where safe, but never invent a replacement operation silently. Validation failures should be visible and recoverable.
Evaluate trajectories, not only answers
Measure whether the agent selected the right tool, supplied valid arguments, respected permissions, asked for approval, recovered from tool failure, and produced a truthful final message. Maintain adversarial tests for prompt injection and unauthorized resource access.
Observe cost and latency
Trace the model call, retrieval, tool calls, workflow steps, retries, and final response. Track success rate, tool error rate, approval rate, model tokens, latency, and cost per completed task.
A production AI agent is not one clever prompt. It is a constrained workflow where probabilistic reasoning can suggest actions and deterministic systems decide what is valid, authorized, and safe to execute.
