CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
CIS 4394 Agentic AI · Fall 2026 · Dr. Xinyu Fu
Last week you built the loop. This week you build the Act arrow. A tool is how a language model reaches something outside itself — a calculator, a database, a payment API — and it is simultaneously the moment your agent stops being a chat window and starts being able to do damage. Tools are capability plus risk surface, and this week is about designing that surface on purpose.
{"name":"calculator","arguments":{"expression":"4817*293*1.18"}}. It does not execute anything — it cannot. Your harness receives that request, validates the arguments against the schema you wrote, decides whether the call is even allowed, runs the function, and hands the result back as the next observation. Same division of labour as Week 4's loop: the model proposes, the harness disposes. Everything valuable this week follows from taking that sentence literally — because if the harness is the only thing that executes, the harness is the only place you need to put controls.Your Berlin supplier invoiced 4,817 units at €293 each, plus 18% VAT. What is the euro total? Ask a language model to do it in its head, and ask it again with a calculator attached.
Nothing in the model multiplied anything. It produced the most plausible-looking continuation, which for long multiplication is a number of roughly the right size. Nobody downstream can tell the difference between this and a right answer.
The tool is about ten lines of Python. The model did not get smarter — it got a calculator, plus a line in the log saying exactly what was computed and with what inputs.
Last week “Act” was a label on an arrow. You stepped through episodes where the agent “called Search” and a result appeared, and we deliberately did not ask how.
Five steps, four of which are ordinary software you write and test. Pages 01 and 02 take them one at a time.
A model's weights were frozen on a date. It cannot know your Q3 numbers, today's outage, or a policy you published last Tuesday. Closed by: a retrieval or search tool.
Your CRM, your ticket queue, your inventory table were never in anyone's training data — and should not have been. Closed by: a read tool against your own systems.
Predicting the next token is not arithmetic, and it is certainly not running a SQL query or a pricing model. Closed by: a calculator, a code runner, a query tool.
Text cannot file a ticket, send an email, or issue a refund. Closed by: write tools — and this is exactly where the risk arrives.
A model without tools is a very expensive autocomplete. Every tool you add is a verb the agent acquires: read, compute, file, send, pay. The business value of an agent is almost entirely the value of its verbs.
Every verb is also a way to be wrong at scale. A read tool leaks; a write tool destroys; a spend tool costs money. The schema you write is where “what is this agent permitted to do?” actually gets answered — in code, not in a policy document.
Because every tool call is a structured record — name, arguments, result, timestamp — a tool-using agent is far easier to audit than one that “just knows.” When compliance asks what happened, you replay the calls.