Tools, orchestration, guardrails & human-in-the-loop

When the task needs actions (not just answers) or a dynamic multi-step path, the AI core becomes an agent: an LLM in a loop calling tools. Designing one in an interview means specifying tools, orchestration, and — the part juniors skip — guardrails.

Tools & orchestration

• Define each tool with a name, description, and JSON schema; the model emits a structured call, your code executes it. That executor is the security boundary.
• Orchestration shapes: single ReAct agent (Thought→Action→Observation loop), fixed workflow (known steps), or orchestrator + specialists for genuinely broad tasks.
• Prefer the least-autonomous shape that works: workflow > single agent > multi-agent. Reliability compounds down (0.9 per step, 5 steps ≈ 59%).

Guardrails & human-in-the-loop

• Hard limits: max steps, wall-clock, and cost caps; loop/progress detection to stop thrashing.
• Least privilege: give each tool the minimum scope; allow-list high-impact actions.
• Human-in-the-loop for irreversible or high-stakes actions (refunds over a threshold, deletes, sends, financial moves) — the model proposes, a human approves.
• Untrusted inputs: treat tool results and retrieved content as data, not instructions (indirect prompt injection).
• Validation & idempotency: check each tool result; make actions idempotent so a retry can't double-charge.