My progress
Menu

Level 7 · Artificial Intelligence and Intelligent Automation · Course 7.2 AI Application Engineering

Module 87: Agents and Tool Calling

Goal: let a model use tools your code provides (look up a customer, check stock, draft a follow-up) safely: how tool calling works, how fixed workflows differ from agents, how to give tools the smallest permissions, how the MCP standard connects tools, and how to keep a person in charge of every action that matters.

You'll need: your grounded assistant from Module 86 and your CRM's API (Level 4 and 5).

Lessons

  1. 1Function calling15–25 minutes✓
  2. 2Workflows and agents15–25 minutes✓
  3. 3Tool permissions15–25 minutes✓
  4. 4MCP15–25 minutes✓
  5. 5Human approval15–25 minutes✓

🛠️Module practice: A tool-using assistant with controls

  1. A read-only customer lookup tool with schema validation, the user's permissions and minimal fields.
  2. A workflow design for enquiry handling, with model, code and human steps.
  3. A tool permission table, and tests for permission refusals and injected instructions in tool results.
  4. A small read-only MCP server for policy search, with its permissions documented.
  5. A drafting tool that creates pending actions, an approvals page, and logged, permission-checked execution.

✅Module check

Explain in a few sentences, in your own words:

How do you let an AI use tools safely?

Show a good answer

A good answer mentions: the model only requests tool calls (from clear names, descriptions and schemas) and your code validates and runs them in a capped loop; workflows with fixed steps are preferred, agents only for open-ended tasks with limits; every tool is narrow, least-privilege and read-only where possible, runs with the logged-in user's permissions, limits results, is logged, and treats inputs and results as untrusted; MCP standardises tool connections but servers must be trusted and scoped; and any consequential action becomes a pending action that a permitted person reviews in full and approves before code carries it out, with the decision logged.

📝Module quiz

10 questions · 10 marks each · 100 marks in all · pass mark 70% · retry as often as you like ·

1. Does the model run the tool itself?

Why each option is right or wrong

  • “Yes, it runs tools directly on the provider's servers” (Incorrect): Your code runs the tool; the model only asks for it.
  • “Only for database tools, which it connects to itself” (Incorrect): No tool is run by the model; your code handles all of them.
  • “Only when the tool has been marked as safe” (Incorrect): Even safe tools are run by your code, not the model.
  • “No, it asks; your code checks and runs it” is correct.

    With function calling, the model replies with a request: which tool and what arguments. Your code decides whether to allow it, checks the inputs and permissions, runs the tool, and sends the result back. The model can't act on its own.

    • Your code is the gatekeeper: validate every argument.
    • Then: return the result for the model's next step.

📖 Revise: Lesson 1: Function calling

Question ID module-87-q1 · Report a mistake in this question
2. Why cap the number of loop steps in an agent?

Why each option is right or wrong

  • “Models have a fixed built-in limit you must match” (Incorrect): The limit is one you choose, to protect cost and safety.
  • “To make the agent's answers arrive faster” (Incorrect): A cap stops runaway loops; it doesn't speed normal runs.
  • “Because each loop step makes the model less accurate” (Incorrect): The concern is runaway cost and actions, not accuracy per step.
  • “To stop runaway loops that waste money or keep acting” is correct.

    An agent repeats: think, call a tool, look at the result. If it gets confused, it may loop for a long time, running up costs or repeating actions. A step limit, such as 10, stops it and lets you handle the failure.

    • Also cap: time and total tokens.
    • When hit: stop and report clearly.

📖 Revise: Lesson 2: Workflows and agents

Question ID module-87-q2 · Report a mistake in this question
3. What's the main difference between a workflow and an agent?

Why each option is right or wrong

  • “Agents are cheaper because they use fewer model calls” (Incorrect): Agents often use more calls, since they decide steps as they go.
  • “Workflows use AI only, while agents use plain code” (Incorrect): Both can use AI; the difference is who chooses the steps.
  • “Agents run on a schedule; workflows run when clicked” (Incorrect): Either can be scheduled or triggered; the difference is control of the steps.
  • “Code fixes a workflow's steps; an agent's model chooses steps” is correct.

    In a workflow, you write the sequence: search, then summarise, then format. The model fills in each step. In an agent, the model decides which tool to use next and when to stop. Workflows are more predictable; agents handle open-ended tasks.

    • Workflow: easier to test and control.
    • Agent: more flexible, harder to predict.

📖 Revise: Lesson 2: Workflows and agents

Question ID module-87-q3 · Report a mistake in this question
4. When should you prefer a workflow?

Why each option is right or wrong

  • “When nobody knows the steps needed to finish the task” (Incorrect): Unknown steps are where agents help; workflows need known steps.
  • “For every chat assistant, whatever the task” (Incorrect): Some chat tasks need flexible steps; choose by how well the steps are known.
  • “When the task needs the model to pick its own tools” (Incorrect): Choosing tools on the fly is what agents do.
  • “When the process is known in advance” is correct.

    If you can write the steps down, such as "classify the email, pick a template, draft a reply", a workflow does it reliably, at lower cost, and is easier to test. Save agents for tasks where the steps really can't be known ahead.

    • Start simple: a workflow first, an agent only if needed.
    • Benefit: predictable cost and behaviour.

📖 Revise: Lesson 2: Workflows and agents

Question ID module-87-q4 · Report a mistake in this question
5. Whose permissions should a tool use?

Why each option is right or wrong

  • “The model's own permissions, set by the provider” (Incorrect): The model has no permissions of its own in your system; the user's apply.
  • “An admin account, so the tool can reach everything” (Incorrect): An admin account lets anyone using the assistant reach everything.
  • “A shared service account with read-only access to all data” (Incorrect): Read-only still lets users see data they shouldn't; use the user's rights.
  • “The logged-in user's, checked in code every call” is correct.

    A tool should be able to do only what the person using the assistant could do themselves. Your code checks their permissions on every tool call, so the assistant can't be used to reach data or actions the user isn't allowed.

    • Pass: the user's identity to the tool, not just the model's request.
    • Test: that one user can't reach another's records.

📖 Revise: Lesson 3: Tool permissions

Question ID module-87-q5 · Report a mistake in this question
6. Why never give a business assistant a general SQL tool?

Why each option is right or wrong

  • “General SQL tools cost more per request to run” (Incorrect): Cost isn't the main issue; the risk of unlimited access is.
  • “SQL queries are too slow for a chat assistant” (Incorrect): SQL is usually fast; the danger is what an unrestricted query can do.
  • “Models can't write SQL that a database will accept” (Incorrect): Models write SQL quite well, which is why unrestricted access is risky.
  • “A wrong or manipulated model could read or change anything” is correct.

    A tool that runs any SQL lets the model do anything the database account allows: read other customers' data, change prices, delete tables. A mistake or an injected instruction could trigger that. Narrow tools, like get_order_status(order_id), limit what can go wrong.

    • Design: one small tool per task.
    • Check: permissions inside each tool.

📖 Revise: Lesson 3: Tool permissions

Question ID module-87-q6 · Report a mistake in this question
7. What does an MCP server provide?

Why each option is right or wrong

  • “A new AI model that runs on your own computer” (Incorrect): MCP connects models to tools and data; it isn't a model itself.
  • “A faster network connection between the app and the provider” (Incorrect): MCP is about tools and data, not network speed.
  • “Automatic backups of the AI app's database” (Incorrect): Backups are a separate concern; MCP exposes tools and resources.
  • “Tools, resources and prompts through a standard protocol” is correct.

    The Model Context Protocol is an open standard for connecting AI apps to outside systems. An MCP server offers tools (actions), resources (data to read) and prompts (templates) in a common format, so many AI apps can use it without custom code for each.

    • Example: a server that lets an assistant search your files.
    • Benefit: build a connection once, use it from many apps.

📖 Revise: Lesson 4: MCP

Question ID module-87-q7 · Report a mistake in this question
8. Why be careful about which MCP servers you install?

Why each option is right or wrong

  • “They can only be used with one AI app at a time” (Incorrect): MCP is designed so many apps can use one server; the concern is access.
  • “They cost money every time they're used” (Incorrect): Many are free; the risk is what they can access.
  • “They need your passwords typed into the chat” (Incorrect): They use configured credentials; the risk is the access they get.
  • “They run code and see data, and could be harmful” is correct.

    An MCP server is software with access to whatever you connect it to: files, email, databases. A harmful or badly built one could leak data or take actions you didn't intend, and its tool descriptions could carry hidden instructions.

    • Install from: trusted sources, and check what access it requests.
    • Limit: give it only the access it needs.

📖 Revise: Lesson 4: MCP

Question ID module-87-q8 · Report a mistake in this question
9. What should an action tool do instead of acting directly?

Why each option is right or wrong

  • “Act immediately, then let a person undo it if needed” (Incorrect): Some actions, like sent emails or payments, can't be undone.
  • “Ask the model a second time to confirm the action” (Incorrect): The same model confirming itself isn't an independent check.
  • “Log the action quietly and carry on without waiting” (Incorrect): A log is useful, but it doesn't stop a wrong action.
  • “Create a pending action for a person to approve” is correct.

    For actions that matter, such as sending an email, refunding money or deleting records, the tool records what it wants to do and waits. A person reviews it and approves or rejects, so a model mistake doesn't reach the real world unchecked.

    • Show: exactly what will happen.
    • Record: who approved and when.

📖 Revise: Lesson 5: Human approval

Question ID module-87-q9 · Report a mistake in this question
10. Why show the full content in an approval screen?

Why each option is right or wrong

  • “To make the screen look more professional to users” (Incorrect): Appearance isn't the point; informed approval is.
  • “To slow down approvals so fewer actions get through” (Incorrect): The goal is informed decisions, not fewer approvals.
  • “It's optional, since the model has already checked it” (Incorrect): The model's output is what's being checked; a person needs to see it.
  • “So the person knows exactly what they're approving” is correct.

    An approval is only meaningful if the person sees what will actually happen: the exact email text, recipient and amount. A vague summary like "Send reply?" lets mistakes and manipulated content through.

    • Show: all fields, as they'll be sent.
    • Allow: editing before approval.

📖 Revise: Lesson 5: Human approval

Question ID module-87-q10 · Report a mistake in this question

ProLearners Assist