Prompting AI Agents
System prompts for tool-using agents: tool descriptions, stop conditions, and guardrails a chat prompt never needed.
An agent prompt is not a chat prompt with tools bolted on — it is an operating manual for an autonomous loop. A chat prompt shapes one reply; an agent system prompt governs many turns of think-act-observe, where the model calls tools, reads results, and decides what to do next without you in the loop. That changes what the prompt must contain: not just tone and task, but the agent's mission, the tools it has and when to use each, how it knows it is done, and what it must never do. Vagueness that is harmless in chat becomes an infinite loop or a wrong irreversible action in an agent.
Tool descriptions are prompt engineering, and they are where most agent bugs actually live. The model chooses tools from their names and descriptions, so each description must say when to use the tool, not just what it does — 'use this to look up an order's current status when the user references an order id' beats 'gets order data.' Spell out argument formats with an example, note side effects (this sends an email; this charges a card), and clarify overlapping tools so the model doesn't pick the wrong one. If an agent keeps calling the wrong tool, fix the descriptions before you touch the model or the temperature.
Stop conditions and loop discipline keep an agent from running forever or quitting early. Tell it explicitly what done looks like and to stop and report once the goal is met — when the refund is processed and confirmed, summarize what you did and end. Give it a path for being stuck: if you can't complete the task after trying the obvious approaches, stop and explain what is blocking you rather than repeating failed calls. Then back the prompt with hard limits in code — max iterations, timeouts. The prompt sets intent; your loop enforces it. Never rely on wording alone to prevent a runaway.
Guardrails and least privilege define the agent's blast radius. State the boundaries plainly — which actions require confirmation, what data it may never expose, when to hand off to a human — and back every high-stakes tool with a real permission check in code, because a persuasive user or a poisoned document can talk a model past a purely textual rule. Give the agent only the tools its job needs; one that can read the database doesn't also need delete. The prompt is one layer, and Module 6 makes the rest concrete: treat everything a tool-using agent can touch as security-relevant by default.