Agents with tools
AI that takes actions through tools you control, not just answers.
What it is
An agent is a language model that can decide which step to take next and then take it, by calling tools: an API that looks up a customer, a function that drafts a letter, a call that creates a task in your claims or ERP system. Instead of returning one answer, it works through a short loop of reasoning, acting and checking until the job is done or it hands over to a person.
The tools are the important part. Each one is a small, well-defined capability that your team writes, tests and owns. The agent can only do what its tools allow, so the list of tools is also the list of things that can go wrong. Good agent design starts with that list, and with the permissions behind each tool, not with the model.
In most enterprise settings, agents work best as careful assistants inside an existing process: gathering information, preparing work and recommending a next step, while people keep the decisions that carry money, legal or customer consequences. The CMA's 2026 guidance on AI agents makes the point plainly: a business is responsible for what its agent does.
Use it when, and think twice when
Use it when
- The work is a sequence of look-ups and small actions across several systems
- Each action can be wrapped in a tool with clear inputs and limits
- A person can review the result before anything irreversible happens
- The volume is high enough that preparation time really matters
Think twice when
- A fixed workflow or a simple rule would do the same job
- The agent would need broad write access to core systems
- You can't log and explain every step it took
- Nobody will own the tools, prompts and test sets after go-live
Reference architecture
01Channels
- Staff assistant or form
- Event from a system
- Customer chat
02Intake
- API GatewayAPI ManagementKong, or your existing API gatewaySingle front door
- Amazon EventBridgeEvent GridApache Kafka or RabbitMQEvents in
03Intelligence
- Agent
Amazon Bedrock AgentCoreFoundry Agent ServiceAn open-source agent framework (e.g. LangGraph) on KubernetesAgent: plans and calls tools - Amazon BedrockMicrosoft FoundryOpen-weight models served with vLLMModel
- Bedrock GuardrailsFoundry guardrails (Azure AI Content Safety)Open-source guardrails (e.g. NeMo Guardrails, Llama Guard)Input and output checks
- Agent
04Orchestration
- AWS Lambda behind AgentCore GatewayAzure Functions behind API ManagementSmall services on Kubernetes behind KongTools as small functions
- AWS Step FunctionsDurable FunctionsTemporalLong-running steps
- Amazon SQSService BusRabbitMQ or Apache KafkaSafe hand-offs
05Systems of record
- ERP, CRM or case system
- API GatewayAPI ManagementKong, or your existing API gatewayReached only through the API layer
06People
- Person
Approve irreversible actions - Person
Review a weekly sample
- Person
- Cloud or platform service (AWSAzuresovereign / on-prem)
- AI agent
- A person decides
- Your existing systems
- Outside your organisation
Components, side by side
| Layer | AWS | Azure | Sovereign / on-prem |
|---|---|---|---|
| Agent runtimeThe original Bedrock Agents (now Agents Classic) closed to new customers on 30 July 2026. | Amazon Bedrock AgentCore | Foundry Agent Service | An open-source agent framework (e.g. LangGraph) on Kubernetes |
| ModelUse the smallest model that passes your test set. | Amazon Bedrock | Microsoft Foundry | Open-weight models served with vLLM on your own GPUs, or IONOS AI Model Hub |
| ToolsEach tool small, tested and least-privilege. | AWS Lambda, exposed through AgentCore Gateway | Azure Functions or OpenAPI tools, behind API Management | Small services on Kubernetes behind Kong |
| Tool permissionsPermissions are enforced by the platform, not by the prompt. | Policy in AgentCore, plus an IAM role per tool | A managed identity per agent in Entra ID, plus API Management policies | Open Policy Agent, plus a Keycloak service account per agent |
| Long-running stepsWaits for approvals without keeping the agent running. | AWS Step Functions | Durable Functions | Temporal |
| Knowledge for the agent | Bedrock Knowledge Bases | Foundry IQ (Azure AI Search) | OpenSearch, or PostgreSQL with pgvector |
| Guardrails | Bedrock Guardrails | Foundry guardrails (Azure AI Content Safety) | Open-source guardrails (e.g. NeMo Guardrails, Llama Guard) |
| Tracing and evaluationLog every tool call with its inputs and outputs. | AgentCore Observability and AgentCore Evaluations, CloudTrail | Observability in Foundry Control Plane (tracing and evaluations), Azure Monitor | OpenTelemetry, Prometheus, Grafana |
| UK data residencyMost AgentCore features run in London. Check that your chosen model is offered in your UK region too. | eu-west-2 (London) | UK South / UK West | Your own UK data centre, or a UK or EU provider |
On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →
Operations
Keeping it reliable
AI fails quietly. These three habits make failure visible before customers see it.
Evaluation
Test on your own cases
Build a test set of a few hundred real, anonymised cases with the right outcome agreed by your experts. Run it before every change to a prompt, tool or model, and block the release if scores drop. Include cases where the right answer is to hand over to a person.
Monitoring
Watch every step
Log each tool call with its inputs, outputs and a summary of the reasoning. Track override rates, tool errors and hand-overs to people. A sudden change in any of them is your early warning.
Cost
Know the price per case
Agents can loop. Cap the number of steps and tokens per case, cache what you can, and report cost per thousand cases beside accuracy, so nobody is surprised by the bill.
Security and failure risks
Prompt injection
A document or email contains hidden instructions, and the agent follows them instead of yours.
How the design avoids it
All content is treated as data, never as instructions. Guardrails filter inputs, and no single tool can do harm on its own.
Excessive permissions
The agent's service account can read and write far more than the task needs.
How the design avoids it
One narrow identity per agent, least-privilege access per tool enforced by the platform, and a person approving anything irreversible.
Data leakage
Personal or confidential data ends up in prompts, logs or a provider's training data.
How the design avoids it
Send only what the task needs, mask sensitive fields in logs, keep processing in UK regions, and confirm in the contract that your data isn't used for training.
Runaway loops
The agent retries or loops, calling tools and models again and again, running up cost and load on core systems.
How the design avoids it
Step and token limits per case, rate limits at the API layer, timeouts, and a hand-over to a person when the limit is reached.
Playbooks that use this pattern
All 55 playbooks using Agents with tools →KYC and customer onboarding
Every application read, checked and summarised before an analyst opens it. Analysts spend their time on judgement, not copying, and a person approves or declines every customer.
- Document AI
- Agents with tools
- Human in the loop
- Event-driven integration
Payment fraud and APP scam detection
Risky payments scored in milliseconds, only the highest-risk band held automatically under rules a person approved, every other alert reviewed by an analyst before any hold, and people making every decision about a customer's payment or claim.
- Predictive ML
- Agents with tools
- Human in the loop
- Event-driven integration
Complaints handling
Every complaint caught, whatever channel it came through, answered fairly within the DISP deadlines, and traced back to its root cause. A handler writes and signs every final response.
- Retrieval (RAG)
- Agents with tools
- Speech and voice
- Human in the loop
Reconciliation and exception handling
Millions of transactions matched every day, the breaks investigated before anyone opens a spreadsheet, and a person approving every posting, with the audit evidence built as the work is done.
- Predictive ML
- Agents with tools
- Human in the loop
- Event-driven integration
Credit decisioning support
Every referred application arrives with the evidence gathered, affordability worked out and the score explained in plain English. A person makes every referred decline, clear-cut cases stay with the existing decision engine and its safeguards, and fairness is checked every month.
- Predictive ML
- Document AI
- Agents with tools
- Human in the loop
Claims intake and triage
Every claim read, sorted and routed within minutes. Simple claims ready for one-click approval, complex ones flagged early, and people making every decision that matters.
- Document AI
- Agents with tools
- Human in the loop
- Event-driven integration
Underwriting submission review
Every broker submission read, its risk data extracted and checked against appetite on the day it arrives, with gaps flagged and a referral note drafted. The underwriter decides, prices and speaks to the broker.
- Document AI
- Retrieval (RAG)
- Agents with tools
- Human in the loop
Damage assessment from photos
Usable photos first time, a likely repair route within hours, and reused or edited images caught before payment. An engineer or handler makes every settlement and total-loss decision.
- Computer vision
- Human in the loop
- Agents with tools
- Event-driven integration
Renewal pricing fairness monitoring
Every renewal price checked against the new-business price before it goes out, every pricing change tested for fair value and proxy discrimination, and clear evidence for the senior manager who signs the attestation. People own every pricing decision.
- Predictive ML
- Agents with tools
- Human in the loop
- Event-driven integration
Patterns
All eight building blocks
AI Explained
Document AI
Read forms, letters and PDFs into structured data.
Retrieval (RAG)
Answer questions from your own documents, with sources.
Agents with tools
AI that takes small, controlled actions across your systems.
Human in the loop
Put people on the decisions that matter, with the evidence.
Predictive ML
Score, rank and forecast from your own historical data.
Event-driven integration
Connect AI to core systems safely, through events and queues.
Computer vision
Inspect photos, video and camera feeds for defects and damage.
Speech and voice
Turn calls and conversations into text, notes and actions.
Thinking about agents with tools in your organisation?
Talk through where it fits, what it would plug into, and which decisions should stay with people.
