What makes an agent — model, tools, loop, guardrails

At a glance

Learning objectives

• Name the four parts of an agent — model, tools, loop, guardrails
• Identify each part in a real registry agent
• Say where DE agents fit — review, triage and planning under guardrails

What you need

• A registry agent to inspect — agent-sql-reviewer is the example throughout
• The Agent Skills format reference
• No installation — this lesson reads, it does not run

Steps

1. Start from a concrete one — agent-sql-reviewer reviews SQL before it merges, catching correctness bugs and fan-out joins. (from agent-sql-reviewer )
2. Its tools are read_file and git_diff_unstaged — the file and diff access the task needs, nothing more. (from agent-sql-reviewer )
3. The rules it applies live in a skill it loads — skill-sql-review. (from agent-sql-reviewer )
4. A skill is a SKILL.md file with front-matter (name, description, version), plus references/, scripts/, and examples/ directories that an agent loads on demand. (from ref-agent-skills )
5. The loop is its workflow — read the diff and the file context, establish the grain of every result set, apply the review rules, emit findings. (from agent-sql-reviewer )
6. Guardrails bound it — read-only, never executes SQL, does not modify files without explicit approval. (from agent-sql-reviewer )
7. Guardrails scale up to a pattern — separate read/recommend from write/execute, and keep a human in the loop for anything irreversible. (from pattern-agent-in-the-loop-review )

Check yourself

• Given agent-sql-reviewer, you can point at its tools, its skill, its workflow loop and its guardrails.
• You can say which part of an agent would execute a DROP TABLE — and which parts are supposed to stop it.

Worked example

tools:      read_file, git_diff_unstaged
skills:     skill-sql-review
workflow:   Read the diff and the file context. Establish the grain of
            every result set. Apply the SQL review rules; stop at the
            first fan-out. Emit findings with file:line and a rewritten clause.
guardrails: Read-only: never executes SQL. Does not modify files
            without explicit approval.

A SKILL.md file with front-matter (name, description, version), plus
references/, scripts/, and examples/ directories that an agent loads
on demand.

Sourced from

• SQL Reviewer
• Agent Skills (open format)
• Agent-in-the-Loop Review

Security scan

Last sweep 2026-10-24: 0 finding(s), 0 marked as examples.

Common gotchas

• An agent is a loop, not a function — it keeps calling tools until the model decides it is done.
• A guardrails list is a promise; hooks are what enforce it.
• Read-only tools still reach real data — review what they can read.

Production considerations

• Prefer agents whose tool list is the minimum the task needs.
• Encode the safety policy as hooks so it holds even when the agent is prompted otherwise.

Diagram

agent anatomy
   |
   |- model --> reasons about the task
   |
   |- tools --> read_file, git_diff_unstaged --> act in scope
   |
   |- skills --> SKILL.md loaded on demand
   |
   |- loop --> read diff -> grain -> rules -> findings
   |
   |- guardrails --> read-only, no unapproved writes, human gate

Registry stats