CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
A shopping agent that finds, compares and buys is the whole course in one transaction: tools, protocols, memory, evaluation — and, above all, the human gate. Every other week you could fix a bad run by running it again. This week the run moves money, and “mostly works” stops being an acceptable answer.
place_order() is a return, a chargeback, a phone call, and sometimes a loss. So: retries need idempotency (a retried order must not become a second order); the loop needs a hard spend cap enforced in the harness, not requested in the prompt; the trace stops being a debugging convenience and becomes the evidence that answers “who authorized this?”; and the human gate moves from a nice-to-have to the thing the system is designed around. Reliability that was “good enough for a draft” is now the difference between a product and a liability.A small task — “restock the espresso pods for the break room, under $60, here by Friday” — touches nearly everything you have built since Week 1. Click each stage to see which week it came from.
Each stage of a purchase maps onto a layer you have already studied. The new part this week is what happens at the stage where money moves — and what has to be true before you let the agent get there.
Everything the merchant needs to trust the sale is bundled into one human sitting at one screen. Fraud controls are built around that assumption.
The click is gone, so consent has to be represented explicitly — as something a merchant can check. That is precisely what the new payment protocols on page 01 are trying to standardize.
Not “what does the model cost” but what does one completed task cost — tokens per step, times steps, times attempts, plus the human minutes spent reviewing and fixing. Until you can quote that number, you cannot compare the agent to the person doing the job today.
Trust is not a feeling here; it is a set of enforced limits. A spend cap, an allow-list of merchants, an approval step on anything irreversible, and a kill switch. Each one is a line of code somebody can point at.
When a purchase is disputed, someone must be able to reconstruct it: what the user authorized, what the agent saw, what it chose, and what it paid. Your Week 2 evidence standard — state before → observation → available actions → selected action → result → state after — becomes a financial control.