An agent is not a prompt. It is a control loop with money attached: a model decides, a tool runs, state changes, and the loop goes around again. Everything that makes agents hard is in that sentence - non-determinism at the decision point, side effects at the tool boundary, and unbounded cost in the loop.
Hiring an agentic AI engineer means hiring someone who treats that loop as a distributed system rather than a clever prompt.
What the work actually is
Control flow
Explicit state, explicit transitions, explicit termination. A step budget, a token budget and a wall-clock budget, all enforced by the harness rather than requested politely in the system prompt. No-progress detection so the agent notices when it has called the same tool with the same arguments three times.
Tool contracts
Tools are an API you are exposing to an unreliable caller. That means narrow signatures, validated arguments, idempotency keys on anything with a side effect, least-privilege scopes, and errors that are readable by a model rather than a stack trace. Most “the agent is dumb” bugs are tool-design bugs.
Memory and context
What the agent carries forward, what it re-derives, what it writes down. Context windows are a budget, not a bucket - and a blackboard the agent writes to beats stuffing every prior turn back into the prompt.
Evaluation
A golden set of tasks with pass criteria, run in CI, with a number attached to every change. Without it, prompt engineering is superstition and every release is a coin flip. With it, you can let a junior engineer touch the prompt.
Guardrails and red-teaming
Prompt injection through retrieved documents, tool abuse, exfiltration through tool arguments, jailbreaks that unlock a dangerous action. These get adversarial test cases in the same suite as the happy path.
AgentOps
Traces you can replay, cost per completed task rather than cost per token, a failure taxonomy that tells you which 5% of runs are eating 60% of the spend, and a rollback that takes a deploy rather than an incident.
Typical engagements
| Shape | Length | What comes out |
|---|---|---|
| Agent architecture review | 1-2 weeks | Written teardown, failure taxonomy, prioritised fix list, cost model |
| Discovery Sprint | 2-4 weeks | Working thin slice, architecture, eval harness, security pre-check, roadmap |
| Embedded build | 4-10 weeks | Production agent behind flags, evals in CI, traces, runbooks, handover |
| Fractional | Recurring | Senior AI judgement in your architecture reviews, hiring loops and roadmap |
Stack I reach for
Python and Go. Claude, GPT and open-weight models behind a routing layer so no single provider is load-bearing. LangGraph or hand-rolled state machines. Temporal when the workflow must survive a restart. Postgres and pgvector before anything more exotic. OpenTelemetry for traces. Docker and Kubernetes, on your cloud or on-premise.
The stack is negotiable. The evals, budgets and traces are not.
Why me specifically
I maintain agentic_security, an LLM vulnerability scanner and red-teaming kit with around 2,000 GitHub stars, and langcorn, which serves LangChain apps and agents through FastAPI. The failure modes on this page are not read from a vendor blog - they came from building the tools other teams use to find them.
I also write about this work in public, roughly weekly, with the argument and the counter-argument both on the page.