AIエージェント

Products use the term differently. The practical questions are what the system can do, under whose authority, and how completion is verified.

主なポイント

• Specify authority and stopping conditions.
• Treat external instructions as untrusted content.
• Verify final state and disclose partial completion.

A typical agent loop observes the current state, selects an action, receives a result, and decides whether to continue. The model may participate in planning or action selection, while ordinary software enforces permissions, budgets, and tool contracts. Define the stopping conditions before execution. A task can be complete, blocked, cancelled, or only partially achieved. Repeated attempts without new evidence can waste resources or repeat harmful side effects. Limit action count, elapsed time, and spending where relevant. External content can contain instructions that conflict with the user’s goal. Treat pages, messages, and tool responses according to their trust level. A document describing an action does not grant permission to carry it out. Evaluate real outcomes. For a file-editing agent, inspect the final files and run appropriate checks. For an account workflow, verify the intended account and state. Record enough evidence to explain what changed and what remains uncertain. More autonomy increases the importance of clear boundaries and recovery procedures.

1. Suppose an agent must create a draft event for Tuesday at 2 p.m. in a specified calendar.
2. The postconditions include the correct calendar, date, time zone, title, and draft state. A successful tool response alone is not enough if it saved to another calendar.
3. Read the resulting record and report any mismatch before declaring the task complete.

The invented workflow demonstrates outcome-based verification.