6 Action: How your agent acts is where strategy meets consequences
Action in an AI agent is not just the moment a tool is called; it is the point where a plan becomes a bounded change in the external world. The chapter emphasizes that success must be judged by task-specific acceptance evidence, not by superficial signals like a model saying it is done, a process exiting normally, or a tool returning a valid response. This matters because agents can be misled by stale state, prompt injection, duplicate requests, or outputs that look correct but do not satisfy the real business goal.
To manage that action gap, the chapter introduces four patterns that each constrain a different part of the problem. Prompt Chaining is for stable, known sequences with checked handoffs between stages. Tool Dispatch narrows a large tool catalog to the eligible capabilities for the current context, then rechecks authority, provenance, and freshness at execution time. Plan-and-Execute preserves dependencies, partial progress, and recovery state across interruptions, while the Guardrail Sandwich places trusted checks before and after a sensitive effect so the agent cannot certify its own result.
The chapter’s central design lesson is to choose the smallest structure that fits the risk and terrain of the task. Read-only or linear work may need only chained stages, while state-changing, branching, or irreversible work may require dispatch, durable planning, and independent verification. The examples and code show how to encode these controls in contracts, evidence records, and execution boundaries so that the system can distinguish proposal from effect, recover safely from failure, and prevent harmful actions from escaping the intended scope.
An Action crosses from a proposal to an external effect. Tool status is execution evidence; task-specific acceptance evidence determines whether the effect is complete.
Prompt Chaining moves named artifacts through a fixed sequence. A failed gate returns evidence to the producing stage or stops the chain; it does not contaminate the next stage.
Tool Dispatch narrows the catalog to an eligible surface before model selection. Runtime admission then checks the selected call against current authority, parameter provenance, and state freshness.
Plan-and-Execute persists a versioned goal, dependency graph, step state, attempts, and evidence. Recovery verifies uncertain effects and changes only the pending affected subgraph.
The Guardrail Sandwich is sequential in time but hierarchical in trust. Protected preconditions and independent postconditions surround a lower-trust execution boundary.
A cross-repository schema change composes Action patterns at different seams: the plan holds dependencies, chains verify local artifacts, dispatch narrows each capability surface, and guardrails surround publication effects.
Summary
- Action is a bounded and verifiable change in the external world, not the presence of a tool call or a green process status.
- An action contract connects the intended effect, execution boundary, state basis, commit identity, and task-specific acceptance evidence.
- Prompt Chaining protects a known sequence by passing named artifacts through intermediate gates. More prompts without checked seams add cost, not control.
- Tool Dispatch computes an eligible capability surface before model selection, then rechecks the exact call's authority, provenance, and freshness. Discovery and schema conformance do not grant permission or prove facts.
- Plan-and-Execute is justified when interruption makes a restart unsafe. It persists dependencies, partial progress, uncertain effects, and evidence; local replanning must not rewrite accepted work or the shared goal.
- The Guardrail Sandwich places lower-trust execution between protected preconditions and independent postconditions. Containment limits reach, but only task-specific evidence can accept the effect.
- Compose patterns at the seams exposed by the task's failure terrain. A chain, dispatcher, plan, and guardrail are choices, not four mandatory layers.
FAQ
What is “action” in an AI agent, and how is it different from a tool call?
Action is the bounded and verifiable change in the external world, not the tool call itself. A tool call is only the mechanism used to attempt the change.
Why isn’t a successful tool response enough to prove a task is complete?
A successful tool response only shows that the call executed correctly. Completion depends on task-specific acceptance evidence, such as a receipt, probe, verified diff, or reconciled state in the real system.
What is the “action gap”?
The action gap is the distance between a model’s proposal and an accepted external effect. It includes risks like stale state, duplicated side effects, wrong tools, or misread return values.
What information should an action contract include?
An action contract should include the intended effect, execution boundary, refreshed state basis, execution rule, commit identity, and acceptance evidence. Together these fields connect a proposal to a permitted and verifiable effect.
When should you use Prompt Chaining?
Use Prompt Chaining when the workflow has a stable order and each stage can hand off a named artifact that can be checked before the next step begins. It works best when the route is known and the seams are the main control points.
What makes a good gate in Prompt Chaining?
A good gate checks more than syntax. It should verify structure, provenance, facts, and acceptance so that bad output does not propagate to later stages.
When should Tool Dispatch be used?
Use Tool Dispatch when an agent has many possible capabilities or when tool arguments contain protected or sensitive values. It narrows the eligible tool set before selection and rechecks admission at execution time.
How is Tool Dispatch different from authorization?
Tool Dispatch is not the same as authorization. Discovery or selection only narrows choices; admission still must verify current authority, provenance, freshness, and the exact arguments for the call.
When should Plan-and-Execute be used?
Use Plan-and-Execute when work can branch, pause, resume, or partially complete, and when an interruption would make blind restart unsafe. It preserves dependencies, progress, attempts, and recovery state in a durable plan.
What is the Guardrail Sandwich, and why is it useful?
The Guardrail Sandwich surrounds a risky action with trusted pre-checks and post-checks. It is useful when an effect is costly, sensitive, or hard to reverse, because it bounds execution and verifies the outcome with authoritative evidence.
Designing AI Agents ebook for free
