Innomerc Learn
English is the default.
AI Security

How AI Agents Work

Inspect the loop from goal to proposed tool action, enforced permission and observed result.

Foundational6 min explorationReviewed
My learningNot started

Choose your depth. Learn at your own pace.

Simple explanation

Understand it

An AI agent can use a model to choose actions toward a goal, often by calling tools and examining results. A tool might search documents, read a calendar or update a record. What the agent can actually do depends on the permissions of the surrounding application.

Cedar’s assistant may propose creating a calendar event. The application should check the user’s intent, destination and permissions before performing the action. A model’s proposal is not itself authorization.

Technical explanation

Under the hood

A typical loop combines instructions, user input, context, a model response, a structured tool request and a tool result. The result becomes new context for the next decision. Tool schemas describe input shapes, but valid JSON does not prove that an action is safe or allowed.

Keep credentials in trusted execution code and scope tools to the task. Validate arguments, recipients, resources and side effects before execution. Memory and retrieved content can carry untrusted information into later turns, so their origin and authority need to remain distinguishable.

Practitioner explanation

Practitioner perspective

Threat-model the agent as a system of identities and capabilities. Evaluate read and write scopes, approval requirements, action budgets, auditability and rollback. A broad service account can turn a small reasoning error into a large operational effect.

OWASP’s Agent Control Standard resource, dated September 2026, emphasizes inspectability and runtime control. This lesson teaches those boundaries conceptually; it does not claim compliance with a particular standard or complete protection from prompt injection.

See the decision happen

Watch it work

A fictional, simplified model. Select a component to inspect it, or follow the steps in order.

Interactive Lab

AI demo production system

Reveal the supporting controls around a model call. This is one illustrative architecture, not a universal stack.

Steps1. Prompt 2. Response
Click a box or choose its name to learn what it means.
User interfaceReadyPolicy gatewayReadyModelReadyRetrievalReadyTool executorReadyAudit +evaluationReadyUser interfaceReadyPolicy gatewayReadyModelReadyRetrievalReadyTool executorReadyAudit +evaluationReady
Ready to traceSmall demo
Before you start · 2 stepsSmall demo

A prompt and model response demonstrate capability but not operational readiness.

How to use this example

Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.

Inspect components & read every step
  • User interface

    The part of an application that people interact with.

    Example: A text box receives a question before the application processes it.

  • Policy gateway

    A control point that checks requests against application rules.

    Example: It may enforce access or usage limits before a model request proceeds.

  • Model

    An AI system that generates output from its input. Its answer can be wrong.

    Example: It drafts an answer using the question and supplied context.

  • Retrieval

    The process of finding relevant information to supply as context.

    Example: A system searches approved documents before asking a model to draft an answer.

  • Tool executor

    Application code that performs an allowed action requested through a tool interface.

    Example: It checks permissions before making an approved calendar lookup.

  • Audit + evaluation

    Records and checks used to examine how a system behaved and how well it performed.

    Example: A team reviews a failed tool call and evaluates whether answers meet its criteria.

Small demo

A prompt and model response demonstrate capability but not operational readiness.

  1. User interface Model: Prompt. The demo passes a prompt directly to a model.
  2. Model User interface: Response. A plausible response returns; production controls are not represented.

Controlled production flow

Independent policy checks protect data and tool actions; monitoring and evaluation support review.

  1. User interface Policy gateway: User request. Authenticate the caller and apply request limits.
  2. Policy gateway Retrieval: Authorized retrieval. Filter documents under the user’s access policy.
  3. Retrieval Model: Context + task. Retrieved text is evidence, not authority to change tool permissions.
  4. Model Policy gateway: Proposed action. The model proposes an action; policy decides whether it can execute.
  5. Policy gateway Tool executor: Approved action. A scoped executor performs only the approved action.
  6. Tool executor Audit + evaluation: Outcome + trace. Record outcomes with appropriate privacy and retention.
  7. Model User interface: Answer. Return the response; evaluation and monitoring remain ongoing.

Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.

Open the detailed lesson walkthrough

Explore the system

User goal

The user asks to prepare a calendar event.

1 / 5

Takeaway A proposed action becomes real only through an enforced boundary.

Read every step without animation

Authorized tool action

  1. User goal. The user asks to prepare a calendar event.
  2. Model proposal. The model proposes a structured action.
  3. Permission gate. The application checks resource scope and the user’s authorization.
  4. Tool execution. The permitted operation runs with scoped credentials.
  5. Result. The agent observes the result and reports what happened.

A proposed action becomes real only through an enforced boundary.

Unrelated instruction

  1. Tool result. An external result contains an unrelated request to transmit data.
  2. Model proposal. The model may propose an action influenced by that text.
  3. Permission gate. The destination and purpose do not match the authorized task.
  4. Denied. The application refuses the action.

Untrusted content does not grant new authority.

Explore deeper: additional experiment
Change an input. Inspect the consequence.

Can an agent execute this action?

Scoped read

The tool can return only documents allowed by the user and connector scope. Retrieved instructions do not expand that permission.

A local teaching model with fictional inputs. It does not test a live system.

Attack view

An untrusted tool result asks the agent to send data somewhere unrelated to the user’s goal. An independent permission gate should refuse the action even if the model proposes it.

Defender view

  • Give tools only the capabilities required for the task.
  • Validate consequential actions outside the model and require appropriate user authorization.
  • Record tool decisions and results without exposing secrets in logs.

Common mistakes

  • A tool schema is not a permission policy.
  • A system prompt is not an access-control boundary by itself.

Check your understanding

Where should tool authorization be enforced?
Active recall: explain this idea in 30 seconds

An AI agent can use a model to choose actions toward a goal, often by calling tools and examining results. A tool might search documents, read a calendar or update a record. What the agent can actually do depends on the permissions of the surrounding application.

Now give an example and name one limitation. Revisit the explanation if you get stuck.

Primary sources

Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.

Content reviewed 2026-09-10. Read the editorial policy.

What comes next?

Professional reference
Understand AI systems

Back to topic

Applying this to your environment? Explore relevant Innomerc Tech services