Anatomy of an agent
Production agents are built from a familiar set of parts. Whatever the branding, most capable agents combine a goal, planner, memory, tools, judge, executor, classifier and guardrail layer. The Fieldbook maps how those components recur across more than 100 named agents and open-source harnesses.
What an agent is made of
Strip away the branding and every production agent resolves to the same eight parts. This is the canonical index of the specimen above: click any row to expand its role, or follow the hub link to its full catalogue.
Reasoning core
The forced-tool-use brain that plans, classifies and dispatches. Its context window and tool-call reliability set the capability ceiling; in this anatomy the model is the router.
Models →Orchestration
One unified front door into the classify, confirm and dispatch loop. Capability grows by adding routes, not branching code. Frameworks, topologies and control patterns live here.
Topologies →Memory & state
Five storage planes across three memory classes. Quality is a property of structured, scored data written at ingest, not a per-call model judgment.
Memory types →Effectors (outbound)
Outbound capabilities bound to skill sockets, gated by capability tier so writes require approval. MCP is the agent-native connector layer, the digital-employee login.
MCP →Transports (inbound)
The unified inbound multiplex: chat, voice, API, MCP, agent-to-agent and computer-use all enter through one ingress. Voice is a first-class transport; A2A is the inter-agent wire.
Protocols →Compute & runtime
The silicon and edge the agent physically runs on: accelerators, HBM, clouds and inference. The deepest dependencies sit upstream with the fabs.
Chips →Durable state
Where the agent is in its work: the statefulness spine from session memory to durable, resumable execution. It survives crashes, long waits and human approval gates.
Runtime →Security & governance perimeter
The perimeter every crossing passes through. Sandboxes, policy engines, auth and approval gates make approval-before-writes a law: agency cuts both ways.
Governance →One shared body plan, rendered as a machined specimen you can take apart
Not every build follows this anatomy exactly, but these are the parts you blueprint against. A reasoning core decides. Orchestration classifies what comes in, interprets it, and dispatches what happens next. Memory holds state where the agent needs it, and durable state tracks where the agent is in its work, surviving crashes, long waits and approval gates. Skills and effectors bind to the tools it is allowed to act with. Transports carry the work in over chat, voice or API. Compute is what it runs on, and a security perimeter with human checks sits around all of it.
Show more
Together they are what lets a system understand an objective, make probabilistic decisions, and work through a sequence of activities on a user's behalf.
What is an AI agent made of?
Eight parts, on the anatomy this field book blueprints against. A model that does the reasoning, an orchestration layer that decides what happens next, memory, durable state that tracks where a job has got to, the tools it is allowed to use, a way for requests to reach it, the compute it runs on, and security checks around the outside. Most production agents have all of these, even where the vendor does not name them.
What is the difference between an AI agent and a chatbot?
A chatbot answers, an agent acts. A chatbot passes your message to a model and shows you the reply. An agent can use tools, remember what happened before, and take several steps on its own to finish a task.
Do AI agents need memory?
Yes, if you want them to do more than one thing. Models are stateless, which means they forget everything between calls. Memory is what lets an agent carry context from one step to the next and use what it learned last time.
What tools can an AI agent use?
Whatever you connect it to: web search, a database, email, a code sandbox, an internal API. Most connections now use MCP, an open standard that lets any compatible agent call any compatible tool (Model Context Protocol).
Are AI agents safe to run on their own?
It depends what they can reach. The main risk is prompt injection, where hidden instructions in content the agent reads make it act against you. The usual answer is to limit what an agent can touch and require human approval before anything irreversible. OWASP ranks prompt injection as the top risk for LLM applications (OWASP).