#Agentic AI
Agentic AI systems operate with autonomy, making decisions and taking actions without step-by-step human direction. These articles explore the observability challenges unique to agentic AI, including LLM-as-judge evaluation, safety metrics, and the lifecycle stages that distinguish agentic from traditional software.
25 posts tagged with agentic ai. ← All posts
Governing a model that answers questions is hard; governing one that takes actions is a different problem entirely. Agentic AI — systems that plan, call tools, and execute steps toward a goal with limited human oversight — moves AI from producing outputs to producing consequences. The governance frameworks built for predictive models and even for chatbots don't fully cover an agent that can send an email, move money, or modify a system. This post is about the controls that specifically matter when AI can act.
Governing a model that answers is hard; governing one that acts is a different problem — a wrong action escapes into the world. Why agents break the usual frameworks, and the controls that bound authority and consequences: least privilege, human-in-the-loop for consequential actions, bounded execution, agent identity, and fail-safe defaults.
An agentic coding tool that lives in your terminal, reads and edits your real codebase, runs commands, and works through multi-step tasks — not an autocomplete, but a collaborator you delegate to.
The opener to a Claude Code series: what an agentic, terminal-native coding tool actually is — it takes a goal and executes multi-step work on your real codebase, with permissions keeping you in control — and the mental model that makes it click.
In a multi-agent system, a shared identity means one compromised agent carries every agent's blast radius. Here's how I split agent identity across three layers.
Most teams give a whole multi-agent app one workload identity, so one hijacked agent has every agent's blast radius. Splitting identity across app, cloud, and crypto layers shrinks it to a single role and makes the audit trail provable.
Prompt injection can hijack what a model says, but not what it's allowed to do — as long as policy lives in a middleware pipeline the model never sees.
A system prompt saying never delete records is a suggestion the model can be talked out of. A gateway that returns FORBID for the delete tool cannot. Put enforcement where the model can't reach it and prompt injection stops mattering for access control.
Passing an SDK client through a checkpointed agent workflow crashed on circular references. The fix reshaped how I cross @step boundaries.
Threading an SDK client through a checkpointed workflow crashed with maximum recursion depth exceeded. The checkpoint boundary is a serialization boundary: JSON only, values and keys, and anything non-serializable gets injected out-of-band at the composition root.
An agent that burns its turn budget without finishing is neither a success nor an error. Give it a distinct outcome and a typed event stream.
The scariest agent failure is the runaway loop that never finishes. Cap every run at max_turns and make EXHAUSTED a first-class outcome, neither a failure nor a silent success, with a typed event stream you can route on.
If your gateway will block a tool call, don't make the agent discover that by trying. Hand it a capabilities brief and stop paying for turns it can't complete.
If your gateway will block a tool call, don't make the agent find out by trying, because each blocked attempt is a wasted turn. A capabilities brief aligns what the model thinks it can do with what enforcement actually allows.
The reference capstone for the 26-part series — every canonical ADK term, defined concisely.
The capstone of the series: every core ADK concept defined in one place — agents and orchestration, tools, sessions/state/memory, context and callbacks, runtime and streaming, models, grounding, evaluation, protocols, and deployment.
An autonomous agent injects its own plan-and-execute tools at runtime. If your gateway is fail-closed, you have to find and allowlist them — deliberately.
An autonomous harness injects its own tools at runtime, tools that don't exist at build time. Fail-closed governance is only complete when it turns that blind spot into a visible block, then allowlists the known-safe internals deliberately.
The full pipeline should run in CI with zero API keys and zero network. A deterministic classifier is the test double that makes an agentic system testable.
Put the seam at the router: same interface, a deterministic classifier for tests. The whole orchestration, routing, gateway, human-in-the-loop, and checkpointing, runs in CI with zero API keys and zero network.
The reference capstone — each term in the series, defined in plain English and grouped by what it does.
The capstone of the series: every LangGraph concept defined in one place — the graph model, state and reducers, persistence, human-in-the-loop, agents and tools, parallelism, streaming, and the surrounding ecosystem.
The higher-level building blocks LangGraph stacks on top of the graph engine — pausing for a human, running an agent loop, calling tools, and fanning out dynamically.
The building blocks on top of the core graph: interrupt() to pause for human input, create_react_agent and ToolNode for tool-using agents, and the Send API for dynamic parallel fan-out with a reducer fan-in.
An agent can tighten a workload's policy, or claim a tool the workload never mentioned — but it can't loosen an explicit forbid. Here's the resolution rule.
An agent can tighten a workload's policy or claim a tool it never mentioned, but it can't loosen an explicit forbid. The subtlety everyone botches: an explicit forbid is a floor, while silence is an absence a tighter layer may fill.
How a checkpointer turns a graph run into something you can stop, reload, and replay from any point in its history.
A checkpointer saves state at every superstep boundary, so a run can pause, resume on a thread_id, and even fork from an earlier checkpoint (time-travel). This is the foundation human-in-the-loop is built on.
Treat agent output quality like a test. A baseline file plus a gate that fails the build on regression turns "the agents got worse" into a red X.
Agent systems rot because nobody catches quality regressions until users do. A committed baseline plus a gate that fails the build turns the agents got worse into a red X and a reviewable diff in the pull request.
Watching a LangGraph run happen — the three things `.stream()` can show you, and why they fall out of the superstep model for free.
stream() exposes a run in three modes: values (full state after each node), updates (what each node changed), and debug (the raw event stream). Streaming falls out naturally from the superstep model.
Deterministic rules get first refusal at zero model cost. Only the unknown cases escalate to graduated AI agents. A human approves anything that mutates.
Deterministic rules get first refusal at zero cost and still fire when the model is down; only the novel long tail escalates to graduated agents; a human approves anything that mutates. Build a ladder, not a model call.
How a single `Command` object folds a state update and a routing decision together — and the tiny lowering that makes `goto` just another guarded edge.
Command lets a node return a state update and a goto in one object, moving the routing decision inside the node. It is the cleanest way to express supervisor handoffs and dynamic control flow.
The single most important pattern in LangGraph — a branch plus a back-edge, and the `recursion_limit` that keeps it from running forever.
Branching plus a back-edge is a cycle, and that cycle IS the agent loop: model proposes tool calls, tools run, control returns to the model, repeat until done. Plus recursion_limit, the guardrail that stops a runaway loop.
How one router function plus a `path_map` dict lowers to exactly one edge firing per step.
A conditional edge is a router function plus a path map: the router reads state and returns a key, the path map turns that key into the next node. This is how branching (and, next post, loops) are expressed.
How the four smallest pieces of the LangGraph API turn a bag of nodes into a program you can run.
Edges, START, END, compile() and invoke() are the four smallest pieces that turn a bag of nodes into a runnable program. Here is the full lifecycle of a tiny two-node graph.
A LangGraph node is just a function — it reads the whole state and returns only the channels it changed.
A node is just a function: it receives the whole current state and returns only the channels it changed. Understand the partial-update contract and the immutable-snapshot guarantee that makes supersteps safe.
The one idea that makes everything else in LangGraph click: nodes don't pass messages, they update a shared state — and reducers decide how.
State is a typed dict of channels; each channel has an optional reducer. No reducer overwrites; a reducer (like add_messages or operator.add) combines. This is the single idea the rest of LangGraph is built on.
The foundational mental model — why "the graph" is a Pregel program, and how shared state differs from message passing.
LangGraph is shared-state, not message-passing, and both models descend from Google's Pregel/BSP: work advances in supersteps that end at a synchronization barrier. Get this mental model first and the whole API stops being magic.
Agents return a clean 200 OK and still be wrong, unsafe, or expensive. Why agentic AI needs a new observability layer — LLM-as-judge, safety metrics, and the four lifecycle stages.
All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.