Agentic & Enterprise AI
Understand the mechanism before adding autonomy. Follow a goal through model decisions, controlled tool execution and returned evidence; then study memory, approval, orchestration and diagnosis. Security and governance remain part of the design, not a final add-on.
Follow the agent's data loop
- The goal becomes context. The application selects instructions, state and permitted tools. Stored history is not automatically part of this model call.
- The model receives the working context. It may propose a tool request or an answer. This proposal has not executed anything.
- The application checks before acting. Validate the proposed operation, arguments, scope and budget. A confident request does not create permission.
- Only allowed work reaches the tool. The tool runs under the application's controlled authority. Consequential writes can require a human approval first.
- The result returns as evidence. Record the observation or error against the tool request. Do not turn a timeout into an invented success.
- New evidence changes the next call. The application includes the result in a fresh model context. Another bounded decision can follow; the loop is not unlimited.
- Finish through an explicit outcome check. When a later proposal is an answer, check its evidence before returning. If blocked, denied or exhausted, stop and state the limitation.
From the agent loop to a working system
Start with the visual guide, inspect the individual mechanisms, then use the local course and risk references.
Follow a document assistant from a user goal through model decisions, authorised tools, observations and verification, with a visual agent loop.
How a model asks for a function to be run, why the model never runs it, and where the boundary between a fluent request and an executed action actually sits.
Separate context, checkpoints, execution archives and long-term memory; design admission, retrieval, correction and deletion with source provenance.
An agent is a model plus a harness. What the harness is, the seven subsystems every one of them implements, and why the hardest parts are context, verification and the credential boundary.
Pausing an agent for human approval: how interruption and checkpointing actually work, what persistence does not guarantee, and the evidence that approval gates decay into rubber stamps.
When to split agent work, how adaptive routing differs from adding workers, and what published research says about coordination failures, verification and cost.
Separate model proposals, tool attempts and real outcomes; follow an uncertain write through a redacted trace and turn the failure into a regression test.
A runnable document-assistant course covering model interfaces, reducers, retrieval evaluation, bounded delegation and persistent approval, with an offline lab and an interactive state diagram.
OWASP LLM03:2026 - excessive functionality, permissions, and autonomy turn a misbehaving model into a damaging action. The controls that bound it.
OWASP LLM04:2026 - model artifacts, adapters, and conversion pipelines as attack surface, why signing is not safety, and the incidents that prove it.
LLM06:2026 - cost asymmetry in LLM applications, and how denial of wallet, capacity exhaustion, and model extraction each need different controls.
Regulation (EU) 2024/1689 in detail - the four risk tiers, provider versus deployer duties, GPAI and systemic risk, phased dates and fine ceilings.
Where generative AI processes personal data, the lawful basis and DPIA analysis, erasure against model weights, and the Dutch DPA's deployment checks.
Keep authority outside generated text. Tool access, document permissions, budgets and approval are application controls, not properties of a convincing model response. Continue toAI Security and AI Governance for the sourced control and regulatory material.