Agent examples

12 complete agent designs — architecture, tool contracts, the real prompts, failure modes, evals and a security read. Every example is a teaching design; companies and datasets in them are invented.

• Support Triage Agent — Reads an inbound support ticket, looks up the customer’s orders and the relevant policy, answers the answerable ones, and hands everything else to a human with a structured summary. (starter; single agent, read-only tools, structured hand-off; 4 tools)
• Meeting notes: decisions, owners, open questions — Turn a 90-minute transcript into decisions, action items with real owners, and open questions — with a reflection pass whose only job is to delete anything the transcript does not support. (starter; Single pass with a reflection step — no tools, no loop, fixed control flow; 1 tools)
• Invoice Extraction: The Build That Is Barely an Agent — Supplier PDFs into validated invoice records — a bounded workflow with a schema-constrained output, and an honest argument about why it should stay that way. (starter; bounded workflow, structured output, validate-and-retry — arguably not an agent at all; 4 tools)
• Research agent with verified citations — An agentic search loop that answers a question in prose, then hands every claim to a separate verifier that reads the cited span and drops anything the span does not actually support. (intermediate; agentic search loop with a verification pass; 4 tools)
• SQL analyst agent — Answers business questions over a warehouse by writing its own SQL — behind a read-only role, a SELECT-only validator, a row cap and a statement timeout. (intermediate; single agent, read-only credentials, generated SQL behind a validator; 4 tools)
• PR Review Agent: Fan Out, Then Refute — A reviewer that splits a diff across four dimension agents, sends every candidate finding to an adversarial verifier that defaults to refuting it, and posts one batched review containing only the survivors. (intermediate; fan-out by review dimension, then adversarial verification; 4 tools)
• The Internal Assistant on MCP: Many Servers, One Governed Gateway — An employee-facing assistant that reads the wiki, the tracker and the health dashboards through MCP servers instead of bespoke integrations — allowlisted, version-pinned, with tool descriptions reviewed as the prompts they are. (intermediate; one agent, many MCP servers, one governed gateway; 5 tools)
• Eval and Judge Harness — Runs a versioned golden set through your target agent in a sandbox, grades outcomes and trajectories with deterministic checks first and judges second, then reports regressions against the last accepted run. (intermediate; offline batch pipeline — the agent that grades your agents; 5 tools)
• Repo Coding Agent: Issue In, Pull Request Out — A supervisor that delegates repo reading to subagents, edits and tests code inside a credential-free sandbox, and touches the outside world through exactly one gated action. (advanced; supervisor + subagents, sandboxed execution, tests as the reward signal; 6 tools)
• Competitive Brief Builder — Supervisor, Three Workers, One Synthesis — A supervisor splits “brief me on X” into three disjoint research angles, three workers investigate in isolated contexts, and a synthesiser merges their reports with per-claim attribution — shown alongside the honest token and latency multiple against one agent doing the same job. (advanced; supervisor + 3 parallel workers + synthesis (fan-out / fan-in, single hop, no worker-to-worker chat); 5 tools)
• On-call runbook agent — Triages a page, runs a fixed bundle of read-only diagnostics, and writes the incident note a human reads at 3 a.m. — it proposes remediation and never performs it. (advanced; Workflow-first with a narrow agentic step: deterministic fetch and bundle, one bounded agentic interpretation loop over read-only tools, and a human approval gate on everything consequential.; 6 tools)
• Browser Task Agent: Filling a Form in a UI With No API — A computer-use agent that drives a legacy broker portal through the accessibility tree — credential-free, egress-allowlisted, and gated on the exact values it is about to submit. (advanced; single agent, one action per turn, grounded in the current accessibility snapshot — inside a hardened, credential-free browser with a deterministic outer harness and an approval gate on every consequential submit; 7 tools)