The learning path

Stage 1: What an agent is

The loop, the tools, the model mechanics — and the vocabulary to reason about all three.

  • What Is an Agent? The Loop That Changes Everything — The one-line definition that actually works — an LLM given tools, run in a loop, with a stopping condition — and the single property that separates agents from chatbots, workflows, and scripts: the model directs the control flow.
  • The Words People Use — Agent, Agentic, Copilot, Assistant — Ten words for overlapping things — agent, agentic AI, copilot, assistant, chatbot, workflow, RPA, orchestration, autonomous, AI employee — used inconsistently by vendors, analysts and bloggers. Rather than a private taxonomy you will be talked out of, this module hands you one disambiguating question that works whatever the vocabulary: which decisions does the model make at runtime, and which are fixed in code?
  • The Agent Loop: One Turn at a Time — The loop, slowed down to its unit of work: what happens inside one turn, a real three-turn transcript, the five stopping conditions that keep loops from running forever, and the anatomy of a tool call — including why its result becomes the next turn’s input.
  • LLM Mechanics for Agent Builders — No Math Required — The five facts about how LLMs actually work that every agent engineer runs into within a week: tokens are the meter, the context window is the whole world, the model remembers nothing between calls, temperature 0 is not determinism, and non-determinism compounds until testing becomes statistics.
  • Tools and Tool Use: The Contract Between Model and World — What a tool looks like from the model’s side of the glass, why the name–description–schema contract is the only documentation the model ever reads, and how tool and result design decide whether your agent works.

Stage 2: Memory, judgment, restraint

What agents remember, when an agent is the wrong answer, and how a real one reads end to end.

  • Agent Memory: Remembering and Forgetting on Purpose — Why LLMs forget everything, the three horizons of agent memory, files as the simplest honest store, the ways memory becomes a bug — stale facts, poisoning, privacy — and why forgetting is a feature.
  • When NOT to Build an Agent — The restraint module. Most problems labeled “agent” are scripts or workflows in disguise — this module gives you the decision table, the honest cost accounting, and the anti-checklist to say so before the budget is spent.
  • Anatomy of a Real Agent: One Run, Every Part Named — Read one complete support-agent run end to end — setup, six turns, one tool error, one recovery, a clean stop — and learn to name every part: the trace, the logs, the evals, and where the risks lived.

Stage 3: Architectures and protocols

Every pattern worth knowing — single agent to multi-agent — then one whole system end to end, how to draw it, and the wire protocols underneath.

  • Single-Agent Patterns: ReAct, Plan-Then-Execute, Reflection — The three canonical ways to structure one agent — interleaved reasoning and acting, upfront planning, and self-critique — with honest tradeoffs on latency, cost, debuggability, and where each one breaks.
  • State Machines vs LLM Loops: Who Owns Control Flow? — The spectrum from fully-coded state machines to free-running LLM loops, what explicit state buys you and what it costs, graph frameworks as the negotiated middle, and the hybrid that actually ships.
  • Workflow Patterns: Five Ways to Compose Model Calls — Prompt chaining, routing, parallelization, orchestrator–worker, and evaluator–optimizer — the five workhorse patterns for composing LLM calls in code, the failure mode each one hides, and a decision procedure for picking the right one.
  • Multi-Agent Systems: When One Agent Isn’t Enough — Supervisor–worker, peer handoff, and debate — when a second agent genuinely earns its tokens, what the multi-agent tax actually costs, and the failure modes (deadlock, divergent state, telephone-game briefs) that only exist once there is more than one context.
  • Subagents and Context Isolation: The Delegation Move — Why the parent’s context window is the scarce resource, how to write a brief a fresh-context subagent can actually execute, what delegation costs in tokens, loss, and latency — and the three patterns (fan-out research, isolated risky work, fresh-eyes review) that earn the overhead.
  • Memory Architectures: Engineering the Context at Scale — The context window is a budget, not a bucket. How production agents decide what earns a slot — compaction that doesn’t destroy the truth, countermeasures for context rot on long runs, four long-term stores compared by their retrieval paths, and write policies that keep memory from becoming a poisoning target.
  • RAG for Agents: From One-Shot Retrieval to Agentic Search — How retrieval actually works — chunking, embeddings, hybrid search, reranking — and what changes when an agent drives the search loop instead of a fixed pipeline. Plus grounding, citations, and the honest RAG vs long-context vs fine-tuning decision.
  • Human-in-the-Loop: Designing the Human Back In — Where human judgment enters the agent loop — the gate spectrum from notify-after to co-draft, which actions deserve gates, why approvals must show the literal tool call, how to pause and resume a run durably, and how to make escalation a designed success.
  • The Framework Landscape: Pick One (or None) — What an agent framework actually buys you, what it costs, an honest tour of the 2026 landscape grouped by shape, and when the right framework is a hundred lines of your own code.
  • Orchestration End to End: One Request Through the Whole System — The connective-tissue module. One real request traced through routing, fan-out, delegation, state, a human gate and a reply — with the seams the pattern modules cannot show you: who owns control at each hop, what crosses each boundary, what happens when worker three fails, and how the whole thing reads as a single trace.
  • Whiteboarding Agent Systems: Drawing the Thing You Built — The communication skill nobody teaches: a small notation for agent systems, the order to put it on the board, four sketches worth knowing from memory, and the script for narrating one in a design review, an interview, or at 2 a.m. during an incident.
  • Function Calling Deep Dive: The Wire Under Tool Use — The mechanics beneath every agent framework: how you declare tools, what a structured tool call actually contains, why arguments are text you must parse and validate, how results get keyed back to a call id, and where the provider dialects differ.
  • Structured Outputs: Getting Data, Not Prose — How to make a model hand your code data instead of paragraphs — the enforcement ladder from prompt-and-pray to schema-constrained decoding, why you validate at the boundary even when decoding is constrained, the retry ladder for when garbage arrives anyway, and schema design as error prevention.
  • MCP Fundamentals: One Protocol Instead of M × N Integrations — The Model Context Protocol from the spec up: why M clients × N integrations collapses into one open standard, the host/client/server architecture, the tools–resources–prompts primitives, stdio and Streamable HTTP, and the trust model that makes installing a server a decision about code you run.
  • Building with MCP: Servers, Clients, and the Install Review — The engineering side of MCP — what a server actually declares, how a client discovers and calls it, where the OAuth story really stands, how to test a server, and the review you owe yourself before installing somebody else’s.
  • Tool Selection at Scale: Forty Tools, One Context — What changes when an agent has forty tools instead of six: choosing a loadout every turn, retrieval-based tool selection and its silent failure mode, namespacing across a dozen MCP servers, reading mis-selection in a trace, and the point where you split the agent instead of filtering the list.
  • A2A and Agent Interop — Honestly Sized — What the Agent2Agent protocol actually specifies — agent cards, tasks, artifacts, three bindings — who verifiably ships it, and the architect’s question that comes first: are you crossing a real organisational boundary, or building a supervisor-worker system inside one stack?
  • Sessions and Streaming: The Conversation Plumbing — The four nouns every agent platform reinvents — session, message, run, step — plus the two streams an agent UI needs (tokens and events), what it takes to reconnect to a long run without double-charging a customer, and the one decision that follows you forever: who stores the transcript, you or the platform.

Stage 4: Building on the clouds

The three managed agent platforms, in practice: deployment, identity, configuration, cost.

  • The Cloud Agent Landscape: Three Managed Platforms, One Map — AWS Bedrock AgentCore, Microsoft Foundry Agent Service, and Google’s Agent Platform side by side — what a managed agent platform actually gives you, what you trade away, the seven concepts all three implement under different names, the shape of their meters, and how to pick one without a feature bake-off.
  • Amazon Bedrock AgentCore, Service by Service — AWS unbundled the managed agent. AgentCore is nine independently usable services — Runtime, Memory, Gateway, Identity, Policy, Code Interpreter, Browser, Observability, Evaluations, plus the Agent Registry — that work with any framework and any model. Learn what each one actually does, how Bedrock Agents Classic maps onto them, and where Strands fits.
  • AWS Agents in Practice: Deploy, Authorize, Guard, Observe, Pay — The day-two module. How an agent actually gets onto AgentCore Runtime and when plain Lambda or ECS is still the right answer; IAM roles versus AgentCore Identity and how an agent acts on behalf of a user; where guardrail checks attach so the model cannot argue with them; how traces reach CloudWatch; and which consumption dimensions dominate an agent bill on AWS.
  • Microsoft Foundry Agent Service, Three Ways to Run an Agent — Microsoft renamed the platform twice and rebuilt the agent primitive once. Learn the current shape: prompt agents (no infrastructure), hosted agents (your container, their endpoint and Entra identity), and ephemeral agents via the Responses API — plus Toolboxes as one governed MCP endpoint, where Microsoft Agent Framework fits, and how publishing and agent identity actually work.
  • Microsoft Foundry Agents in Practice: Identity, Boundaries, Guardrails, Traces, Bills — Day two on Microsoft Foundry. Every agent gets an Entra identity and can act on behalf of a user — decide when it should. Standard setup pulls conversation state into your own storage, search and Cosmos DB, and network injection is a one-way door. Guardrails scan four intervention points including tool responses for cross-prompt injection, and they are one layer, not the defence. Then traces into Application Insights, version rollback, and the two shapes of a Foundry agent bill.
  • Google’s Agent Stack: ADK, Agent Runtime, and the Names That Keep Moving — Google ships the agent stack in two halves: ADK, an open-source, five-language framework you can run on your laptop, and a managed platform — Agent Runtime, Sessions, Memory Bank, Agent Gateway — that runs it for you. Learn the pieces, the ADK vocabulary, the runtime’s operational and billing shape, Google’s A2A posture, and the guardrails that actually bind — with the branding churn labelled honestly.
  • Choosing a Cloud for Agents: A Decision You Can Defend — The synthesis module. Not what the three platforms are — you already know that — but how to decide between them: the axes that actually carry weight (data gravity, identity provider, delivery surface, boundary constraints, commitments, team skills), what travels when you change your mind, the security invariants that must hold on any cloud, how to run an honest bake-off, and a decision tree that ends in a recommendation you can put in writing.
  • The Well-Architected Agentic AI Lens: 41 Questions Worth Borrowing — AWS published a Well-Architected lens for agents on 10 June 2026 — 6 pillars, 41 focus-area questions, 150 best practices, 90 of them rated High risk. This module gets you all 41 questions without reading 150 pages of vendor documentation, then draws the line that matters: the questions travel to any platform, the answers are AWS services, and a completed review is a conversation record rather than a certificate.

Stage 5: Ship it safely

The agent threat model and the containment toolbox — injection, scoping, sandboxes, guardrails.

  • The Agent Threat Model — The map of how agents get attacked: one token stream that cannot tell instructions from data, an agent that turns that confusion into actions, the lethal trifecta that makes it exfiltration, and the OWASP taxonomies that name the rest.
  • Prompt Injection: The Vulnerability With No Patch — Instructions and data share one channel by construction, so an agent cannot reliably tell your orders from an attacker’s. Direct injection, indirect injection, and tool-output poisoning — and why containment, not detection, is the strategy that holds.
  • Tool Scoping and Least Privilege: Making the Dangerous Thing Impossible — Containment, part one — the permission surface. Because the model can be talked into anything, the runtime has to make the dangerous action impossible: read-only defaults, parameter constraints enforced in code, scoped short-lived credentials, egress allowlists in infrastructure, and gates that bind to exact parameters.
  • Sandboxing and Computer Use: Isolation for What You Cannot Pre-Approve — Containment, part two. Scoping tools handles the calls you can enumerate; sandboxing handles the ones you cannot — agent-written code, shell commands, and browsers pointed at the open web. The isolation ladder, sandbox hygiene, and the containment rules for computer use.
  • Agent Identity, Auth, and Secrets — Two questions decide every agent authorization design: what may THE AGENT do, and on WHOSE BEHALF is it acting? Per-agent identity, on-behalf-of delegation, short-lived task-scoped credentials, secrets that never touch the context window, and audit trails that survive an incident.
  • The Guardrail Catalog: Runtime Checks, Mapped Per Cloud — Guardrails are runtime checks that live outside the model — input filters, output classifiers, tool-call validators, PII redaction, grounding checks. Build them as a reusable catalog (risk → check → placement → cost), map each entry onto Bedrock, Foundry and Gemini Agent Platform, and learn why a catalog without containment is theatre.
  • Supply Chain and MCP Security: Code You Run, Content You Trust — Every tool integration you install is two attack surfaces at once — a process running with your credentials and a writing channel into your model’s context. The attack taxonomy, the disclosed incidents, the review that catches them, and the allowlist process that scales it.

Stage 6: Prove it works

Traces, golden datasets, LLM judges, regression suites, and budgets you can defend.

  • Trace Anatomy: Reading an Agent Run Like a Professional — The trace is the only record you get of a run that will never repeat. Learn what a span carries, what to record on model calls, tool calls and decisions, where the OpenTelemetry GenAI conventions actually stand — then diagnose three traces that look fine and are not.
  • Eval Fundamentals: You Cannot Improve What You Cannot Measure — The centrepiece discipline of agent engineering: turning “it worked when I tried it” into a pass rate on a golden dataset. Build the dataset, separate outcome evals from trajectory evals, climb the grading ladder from deterministic checks to judges, and turn every incident into a permanent test case.
  • LLM-as-Judge: An Instrument You Calibrate, Not an Oracle You Trust — A model grading a model is a measuring instrument with known biases and a drift problem. Learn when a judge is the right tool and when it is lazy engineering, how to write rubrics a judge can actually apply, the five biases and their mitigations, and the calibration protocol that turns a judge score into evidence.
  • Regression Suites in CI: Evals That Run On You — The discipline that turns a pile of eval cases into a gate nobody can walk around: a deterministic-first pyramid, per-commit and nightly tiers, pinned model versions, honest thresholds over N runs, and the offline-to-online bridge that catches what your golden dataset never will.
  • Observability in Production: Watching Agents at Scale — You cannot read ten thousand traces a day. Learn the three signals a production agent must emit, how to alert on distributions instead of single runs, what the observability platforms actually do as of September 2026, how online evaluation catches drift you never deployed — and the five charts an agent team really looks at.
  • Cost and Latency Budgets You Can Defend — Where an agent run’s tokens actually go (the whole transcript resends every turn, so cost grows quadratically-ish with turn count), which levers really cut cost and latency, how to enforce a budget in the runtime instead of wishing for one in the prompt, and how to bake off cost, latency, and quality on the same golden set.

Stage 7: Run it for real

Versioning, rollout, incidents, tenancy, and the org patterns that keep agents alive in production.

  • Release Validation Gates: What Stands Between a Change and Production — The automated gate an agent change has to clear — why it is statistical rather than boolean, the agent-specific checks no generic pipeline runs (tool contracts, permission diffs, trifecta legs, version-tuple pinning), where cloud posture and vulnerability scanners actually fit, and the limits of gating known-bad.
  • Deploying and Versioning Agents: Ship It Like Software — Agents are software, so ship them like software: pick a deployment topology on purpose, treat prompt + toolset + model + parameters + framework as one atomic version, evaluate a model upgrade like a database migration, and make rollback possible before you need it.
  • Rollout and Kill Switches: Controlled Exposure — How to put a new agent version in front of real users without betting the business on it — the shadow → canary → flag → full ladder, the four canary metrics that actually catch agent failures, and kill switches at a granularity you can afford to pull.
  • Monitoring and Incident Response: When the Agent Is the Incident — The eight ways agents fail in production — symptom, detection signal, first response — the alarm set that catches each one, and an incident process adapted from SRE for a system that keeps taking actions while you argue about it: declare early, contain first, then reconstruct what the model saw.
  • Reliability Plumbing: Timeouts, Retries, Idempotency, Breakers — The unglamorous machinery that keeps agents alive: nested timeouts at every layer, retries with judgment instead of reflex, idempotency keys so the model can ask twice and your runtime executes once, circuit breakers and backpressure for flaky tools and exhausted quotas, and deterministic fallbacks that degrade to less autonomy instead of improvising.
  • Multi-Tenant Isolation: One Platform, Many Customers, Zero Bleed — Running one agent platform for many customers means every shared surface — context, memory, credentials, caches, traces, quotas — is a potential cross-tenant leak. The four bleed paths, the isolation boundary at each layer, what AgentCore and Foundry verifiably give you versus what stays your design, and how deletion requests reach agent memory.
  • AgentOps Org Patterns: Maturity, Team Shapes, and Gates That Scale — The organizational layer of running agents — a four-tier maturity ladder you can diagnose honestly, the platform-vs-product split that decides what to centralize, the three review gates that scale with trigger-based reviews instead of calendar boards, who actually owns evals and carries the pager, and the first three things to stand up: traces, a golden set, a kill switch.
  • Where Agents Meet the Law — A deliberately short bridge: why autonomous action is exactly what regulators are looking at, how the practices this course already taught you double as governance evidence, and when to stop and call the governance function. For the law itself, we point you at our sibling site.