The six pieces of any agent
Every agent has these six parts — not just the one in this course, but every agent, in every language, in every framework. Learn the anatomy once and frameworks become vocabulary rather than magic.
| # | Piece | What it is | The question it answers |
|---|---|---|---|
| 1 | Model | Which LLM does the deciding. Usually one string. | Whose judgment is this? |
| 2 | Tools | Functions the model may ask you to run. | What can it do? |
| 3 | Instructions | The system prompt. English, not code. | How should it behave? |
| 4 | Memory / state | The message list you resend each turn. The model itself is stateless. | What does it know so far? |
| 5 | Orchestration | The loop. Decides who acts when, and when to stop. | Who acts next? |
| 6 | Guardrails | Limits enforced in code, which the model cannot talk its way past. | What can it never do? |
Where they live in this course’s final file
Section titled “Where they live in this course’s final file”| Piece | In step7.py |
|---|---|
| Model | model="qwen2.5:3b" |
| Tools | get_transaction() + its schema |
| Instructions | the system message |
| Memory | the messages list |
| Orchestration | the while True loop |
| Guardrails | decide(), the input() gate, the audit log |
Three things the frame makes obvious
Section titled “Three things the frame makes obvious”Instructions and guardrails look similar and behave nothing alike. Both constrain the agent. One is a polite request inside a prompt that the model may ignore — and will, eventually. The other is enforced by the interpreter and cannot be negotiated with. If a rule must hold, it goes in code.
Guardrails are never in one place. A decision rule, an input gate, an append-only log, a lookup that fails safe. That scattering is correct — it’s defence in depth, and no single control is trusted to hold. When someone asks “where are your controls?”, the answer should be a list.
Memory should be per-call, not global. State that lives at module level leaks between runs. Build the message list fresh for each case, so two runs can never contaminate each other — that’s what makes an agent safe to call from a larger system.
Reading a framework through this lens
Section titled “Reading a framework through this lens”LangGraph, CrewAI, the OpenAI Agents SDK, Anthropic’s Agent SDK — all of them are these six pieces with different names. Orchestration becomes a graph, or a Runner. Memory becomes a session object. Guardrails become recursion limits and permission hooks.
The question when you meet one is never “how does this work?” It’s “where did they put my six pieces, and which ones did they take away from me?” Frameworks trade control for convenience. Having built the raw loop by hand, you can judge that trade instead of accepting it.