AI agents in knowledge work: from retrieval to action

01

What is the difference between an AI agent, a chatbot and a fixed workflow?

A chatbot answers a message and waits. A fixed workflow calls a language model at predetermined points in a programmed sequence. An AI agent receives a goal and decides its own route: it chooses tools, reads results and decides the next step. That makes it more flexible, and harder to predict.

Anthropic's guide to building agents (Anthropic, 2024) distinguishes two designs: workflows, where language models and tools are orchestrated through predetermined code paths, and agents, where the model directs its own process and tool use. The guide's recommendation is pragmatic: find the simplest solution and add complexity only when it is needed. Often a single model call with good retrieval of matching passages is enough.

How agents fit into the larger picture of capturing, finding and applying knowledge is covered in Knowledge management with AI.

02

How does the agent loop work?

The agent loop repeats four steps: the model plans its next step from the goal and the history so far, calls a tool, reads the result back into context, and decides whether the goal is met. The loop ends with an answer, a question back to a person, or a fixed stop condition such as a maximum number of steps.

The basic pattern goes back to research. ReAct (Yao et al., ICLR 2023) interleaves reasoning steps and actions: the reasoning steps help the model form and adjust a plan, the actions connect it to external sources. According to the paper, even a simple Wikipedia interface reduced hallucination and error propagation compared with pure step-by-step reasoning. Toolformer (Schick et al., arXiv 2023) showed that a model can learn to decide for itself when to call which interface with which arguments.

Every round adds the call and its result to the context. After many steps, early instructions compete with long tool outputs for the model's attention. Building an agent therefore also means setting stop conditions, trimming or summarising older results, and carefully choosing what the model actually sees. This discipline is called context engineering and is covered in more depth in Context engineering: why it matters.

03

What is a tool for an AI agent, and how does the model call it?

A tool is a described function with a name, a description and an input schema. The model sees these descriptions and, when it needs a tool, generates a structured call with matching values. The surrounding software executes the call, not the model. The result goes back into the context as text or structured data.

{
  "name": "search_documents",
  "description": "Searches approved internal documents and returns passages with their source. Read-only.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": { "type": "string", "description": "Search query in natural language" },
      "collection": { "type": "string", "enum": ["manual", "policies", "minutes"] },
      "max_results": { "type": "integer", "minimum": 1, "maximum": 10 }
    },
    "required": ["query"],
    "additionalProperties": false
  }
}

The description is part of the context, and therefore part of the control. A tool called "database" with a free-text query field tempts the model into calls nobody anticipated. A tool called "search_documents" with a fixed value range only allows what is intended. The OWASP Top 10 for LLM Applications (OWASP, 2025) recommend exactly that: narrowly scoped tools instead of open-ended functions such as free shell commands.

Errors are part of the interface too: the MCP specification returns execution errors, such as a date in the wrong format, to the model as a result, so it can correct the call. Uninformative error messages produce loops.

04

What is the Model Context Protocol, and where does it come from?

The Model Context Protocol (MCP) is an open protocol through which AI applications connect to tools, data and templates from external systems in a uniform way. Anthropic published it on 25 November 2024 and handed it to the Agentic AI Foundation, under the Linux Foundation, in December 2025. Messages follow JSON-RPC 2.0 between host, client and server.

Anthropic introduced MCP as an open standard meant to replace fragmented, one-off connections between AI applications and data sources with a single protocol (Anthropic, 2024). On 9 December 2025, the Linux Foundation announced the formation of the Agentic AI Foundation, whose founding projects include MCP as a contribution from Anthropic (Linux Foundation, 2025). The specification is released in dated versions and names the Language Server Protocol as its model, which brought programming languages into development environments in a uniform way.

The protocol does not mandate security, it describes security as a task for the implementation. Per the specification, tools stand for arbitrary code execution, hosts should obtain explicit user consent before every tool call, and descriptions of tool behaviour count as untrusted unless they come from a trusted server. API, MCP or CLI sets out when MCP pays off compared with a direct interface.

05

What is agentic retrieval (Agentic RAG), and when does it pay off?

Agentic retrieval leaves it to the model whether, what for and how often to search. Instead of one search before the answer, the agent rephrases queries, breaks compound questions apart, checks whether the passages found are sufficient, and searches again if needed. This pays off for questions spanning several sources, but costs extra model calls and response time.

Classic RAG searches once and then answers with whatever it found. If the first search fails, the answer fails too. Self-RAG (Asai et al., ICLR 2024) trained a model to retrieve on demand and to assess the passages it found itself, using special reflection tokens, instead of always including a fixed number of passages. The survey by Singh et al. (arXiv 2025) organises agentic retrieval along four design patterns: reflection, planning, tool use and multi-agent collaboration.

A middle path is often more effective than full autonomy: a fixed pipeline, extended by exactly one agentic stage, such as breaking a question into sub-questions. Query decomposition and the advanced RAG toolkit shows which technique fixes which failure. How retrieved passages get cited in the answer is described in Retrieval-augmented generation explained.

06

Where should approval points sit in an AI agent?

Approval points belong before any step that acts outward, cannot be undone, or changes rights: sending messages, changing or deleting records, placing orders. An agent can carry out reading and preparatory steps on its own. What matters is that approval is enforced in code, not left dependent on whether the model asks permission.

The MCP specification recommends that a person can always decline tool calls, with a clear display of which tools the model may use, visible indicators on every call, and confirmation dialogues. The OWASP Top 10 for LLM Applications (OWASP, 2025) trace the risk of excessive agency to three causes: too many functions, rights that are too broad, and too much autonomy for consequential actions. Among their countermeasures is enforcing authorisation in the downstream systems, rather than leaving it to the model's decision.

In practice, that means an agent acts with the rights of the person it works for, not with a blanket account that sees everything. How document-level access rights carry through into search and the answer is described in Access control in AI knowledge systems.

07

What failure modes are typical for AI agents?

Typical failure modes are loops, where the agent calls the same tool repeatedly; choosing the wrong tool or the wrong parameters; rights that reach too far; instructions smuggled in through content the agent reads; and silent partial success. Agents rarely crash. They deliver plausible but incomplete or wrong results, which only a check reveals.

Injected instructions deserve particular attention because agents read content from outside sources. Greshake et al. (arXiv 2023) described indirect prompt injection: attackers place instructions in data that a model later retrieves, exploiting the fact that LLM-integrated applications blur the line between data and instructions. Defence and mitigation are covered in AI security: prompt injection and data leakage.

08

How do you measure whether an AI agent works reliably?

An agent's reliability is measured across repeated runs of the same task, not a single successful case. Both the final result and the route are assessed: which tools were called with which values, how many steps were needed, and where the agent stopped. Added to that are the effort and time per completed task, and a human spot check.

The τ-bench benchmark (Yao et al., arXiv 2024) introduced the pass^k metric for this: it measures how often an agent solves the same task in all k repetitions. The difference from a simple success rate matters for operations. An agent that solves a task in eight out of ten runs looks convincing in a demo and still gets one in five transactions wrong in daily use.

How answers are checked for faithfulness to source and relevance is covered in more depth in Checking AI answers.

09

Which assumptions about AI agents lead in the wrong direction?

Several assumptions lead in the wrong direction: that an agent is inherently better than a fixed process, that a standard protocol makes integrations secure, that more tools mean more capability, that the model can decide on permissions, and that one successful run proves reliability. Each of these can be checked against research or the specification.

10

How do you introduce an AI agent into knowledge work step by step?

An agent is introduced in stages: first check whether a simpler solution solves the task, then run an agent with a few reading tools and a complete log, then add preparatory steps whose result a person approves. Steps without confirmation only become an option once logs and repeated tests show they succeed reliably.

Which tasks in an organisation suit agents, and what permissions and logging look like in implementation, is described in AI agents for organisations. A purpose-built agentic pipeline from the R&D Lab is shown in Event Scout.

iiterate Technologies GmbH develops AI applications and custom software from architecture through implementation to operation, on client infrastructure or in EU hosting, with a focus on RAG, local language models and connecting to existing systems (Services).