AI agents explained: tools, memory, guardrails
An AI agent is a language model that is given a goal, instructions and a set of tools, and decides for itself which step to take next, looping until the task is done. A plain chatbot call answers once; an agent can look something up, call an API, check the result and try again. The decision rule for exams: when the requirement is to know something, use retrieval; when it is to do something, use a tool the agent calls; and when an action cannot be undone, put a human approval step or a deterministic rule in front of it.
The parts of an agent, layer by layer
1. The model and its instructions. The model reasons about the request. The instructions set its role, scope and what it must refuse. Instructions are interpreted by the model, so they are guidance, not enforcement.
2. Tools. A tool is a function the agent may call: a search, an API, a database query, a flow, code execution. The agent sees a name, a description and the inputs, and chooses a tool from that description. Poor descriptions produce wrong tool choices, which is why tool design appears in exams. Protocols such as MCP (Model Context Protocol) standardise how an agent discovers and calls tools exposed by other systems.
3. Memory. Two different things share the word. Conversation memory keeps what was said so far, so the agent can follow a multi-turn exchange. Retrieved knowledge is content fetched from a store at question time, as in RAG. They solve different problems; an exam will offer the wrong one.
4. Planning and the loop. The agent breaks a goal into steps, acts, reads the result and decides whether to continue. Anthropic’s engineering guidance draws a useful line: a workflow runs the model and tools along paths that code predefines, while an agent lets the model direct its own process and tool use. More autonomy means more flexibility and less predictability.
5. Guardrails. Content filters, limits on which tools are exposed, scoped identity and permissions, and human approval for consequential steps. The rule worth memorising: anything that must happen the same way every time (a calculation, a mandatory phrase, a payment limit) belongs in code or configuration, not in a polite instruction.
6. Evaluation and tracing. An agent can be wrong in the middle of a run, so teams trace each model call and tool call and test with fixed scenarios, before and after publishing.
A worked example
A returns agent for a webshop receives: “I want to return order 1042 and get my money back.”
- The model decides it needs the order. It calls a
get_ordertool with the number. This is a lookup action. - It checks the return policy. The policy is text, so it uses retrieval over the policy document: it needs to know, so no action is taken.
- The order is within the return window. The agent prepares a refund. A refund is irreversible money movement, so the design pauses the run and asks a human to approve.
- After approval, it calls
issue_refundwith the order number. The refund limit is enforced inside that function, not in the prompt. - It replies to the customer and records the run in the trace.
Steps 1 and 4 are tools, step 2 is retrieval, step 3 is a guardrail, and the limit in step 4 is a deterministic control. Each design choice maps to one exam answer.
How three vendors use the word
| Platform | How “agent” is used | Notes verified in official documentation |
|---|---|---|
| Microsoft Copilot Studio | An AI assistant that handles conversations and completes tasks using instructions, connected knowledge sources and tools | Agents can run on different “harnesses”; on the standard harness a request is matched to a topic, with generative answers from knowledge as a fallback. Agent flows can be attached as tools and can include human review |
| Microsoft Foundry Agent Service | A managed service for building and running agents, defined by a model, instructions and tools | Agent types are prompt agents (configuration only), voice-based prompt agents (in preview) and hosted agents (your own code in a container). Each agent can have its own Microsoft Entra identity; hosted agents get a dedicated one automatically |
| Salesforce Agentforce | An agent that classifies a request, uses instructions and chooses actions such as Flows, Apex or prompt templates | Salesforce now calls what were topics subagents. Instructions are not deterministic, so enforcement belongs in filters and coded actions. The newer builder uses Agentforce Script and hybrid reasoning for deterministic control |
The vocabulary differs (topics, subagents, prompt agents, harness), but the structure is the same: a model, instructions, tools, knowledge and controls. Product names and features here change often, so check the exam’s current outline for the exact terms.
Which exams test this
| Exam | How it appears | Where on this site |
|---|---|---|
| AI-103 | Implement generative AI and agentic solutions (30–35%): define agent roles, goals and tool schemas, combine retrieval, function calling and conversation memory, orchestrate multiple agents, and add safeguards and approval steps; the planning domain adds oversight modes and tool-access controls | Generative AI and agents explained |
| AI-901 | Implement AI solutions by using Microsoft Foundry (55–60%): create and test a single-agent solution in the Foundry portal and a lightweight client app for it; the AI concepts domain asks to recognise agentic AI workloads | Foundry implementation explained |
| AB-620 | Plan and configure agent solutions (30–35%) and Integrate and extend agents (40–45%): identity strategy, human-in-the-loop agent flows, tools such as MCP, REST APIs and computer use, and multi-agent solutions with Foundry agents or the A2A protocol | Integrate and extend explained |
| AB-100 | Design AI-powered business solutions (25–30%): design task, autonomous and prompt-and-response agents, agent extensibility with MCP and computer use, and agent behaviours in Copilot Studio | Design AI solutions explained |
| Agentforce Specialist | AI Agents (35%): how agents work, hybrid reasoning, deterministic behaviour with filters and variables, topics and actions, the security context an agent runs in, and Employee versus Service agents; Multi-Agent Orchestration (5%) adds MCP and A2A | AI agents explained (Agentforce) |
| Databricks GenAI Engineer | Design Applications (14%): define and order the tools an application uses to gather knowledge or take actions; Application Development (30%): build agentic systems with MLflow and Agent Framework; MCP servers and agent evaluation appear in later sections | Application development explained |
| AIF-C01 | Domain 2, Fundamentals of GenAI (24%): agentic AI concepts such as multi-agent patterns, MCP, memory, tool use and orchestration; Domain 3 (28%): the role of agents and their business applications | Foundation model applications explained |
| MLA-C02 | Deployment and Orchestration (24%): deploy and configure agents with tools and communication protocols, manage agent state and agentic workflow infrastructure; Domain 4 adds monitoring of agent performance and tool failures | Deployment and orchestration explained |
| AB-730 | From October 20, 2026, Drive business outcomes by using agents (20–25%): choose a prebuilt or custom agent for a task and delegate multi-step work to Copilot Cowork; agents are used, not built | Agents and Cowork explained |
| AB-900 | Perform basic administrative tasks for Copilot and agents (25–30%): user access to agents, creating an agent, the approval process and monitoring; an admin view, not agent design | Copilot and agent admin explained |
| SC-500 | Secure compute domain (20–25%), implement security for AI: Entra Agent ID, protection for Copilot Studio agents and guardrails for agent security in Foundry; a security angle on agents only | Secure compute explained |
| CY0-001 | Agent access controls (2.3), excessive agency as an attack (2.6) and AI agents for automating security tasks (3.3); a minor topic | Only the cheat sheet touches it (excessive agency) |
| 200-301 | CCNA v2.0 only (from February 3, 2027), AI and network operations (10%): describe the role of agentic AI in network operations; not in v1.1 | AI and network operations explained |
How exam questions are built around it
- Know versus do. “Look up current stock” or “answer from our documents” is retrieval. “Create a ticket”, “update the record”, “send the email” is a tool or action.
- Always, never, exactly. These words signal a deterministic mechanism such as filters, variables, a flow or code. A better-worded prompt is the trap.
- Irreversible actions. Payments, deletions and customer emails want human approval. If the scenario says a person must approve every action, a fully autonomous design is wrong.
- Identity. An agent acts as someone. “Users must only see what they are allowed to see” wants the user’s identity; a shared service identity sees everything. An agent that works in testing and fails in production often runs under a different security context.
- Agent or workflow. A fixed, repeatable sequence is better as a flow or workflow. Use an agent when the steps cannot be listed in advance.
Practice questions
Question 1. An agent that answers HR questions must also open a leave request in the HR system when an employee asks. The agent already retrieves answers from the leave policy. What does it need to add to open the request?
- A. A larger index of leave policy documents
- B. A longer system prompt describing the leave process
- C. Conversation memory across sessions
- D. A tool that calls the HR system to create the leave request
Show answer
Answer: D
Opening a request is an action, so the agent needs a tool or action that calls the HR system. Retrieval supplies knowledge only and cannot change a record. A longer system prompt does not give the agent the ability to act. Conversation memory only keeps earlier turns.
Question 2. A finance agent may issue customer refunds. Policy states that refunds above a fixed limit must never be issued without manager approval, and this must hold every time. Which design meets the requirement?
- A. Enforce the limit and the approval step in the refund tool or flow
- B. Tell the agent in its instructions to avoid large refunds
- C. Raise the model temperature so the agent weighs each case
- D. Fine-tune the model on examples of approved refunds
Show answer
Answer: A
A rule that must hold every time is enforced deterministically: the refund function checks the limit and requires a manager approval step above it. Instructions are interpreted by the model and are not a guarantee. A higher temperature makes behaviour less consistent. Fine-tuning shapes tendencies and still cannot guarantee a limit.
Go deeper
- What is Microsoft Foundry Agent Service? (Microsoft Learn)
- Microsoft Copilot Studio overview (Microsoft Learn)
- Agentforce guide to context engineering: hybrid reasoning, Script, subagents and actions (Salesforce)
- Building effective agents (Anthropic)
- Next on this site: RAG explained, Fine-tuning vs RAG vs prompting and How to study for certification exams.