An LLM produces text and nothing else. That is enough when words are the deliverable. It is useless the moment something in the world has to change. This half of the playbook is about the second case, one capability at a time.
If you remember only one thing: an LLM reads text and writes text. That is all of it. Everything else an agent seems to do -- looking something up, remembering you, booking a table -- is a capability you build around it.
There are nine such capabilities. There is also a tenth thing that is not a capability at all: the discipline of checking whether the other nine did their job.
None of the ten is exotic. You use every one yourself, several times a week, without giving any of them a name. This page shows them at work in three weeks of ordinary human effort, all spent organising one dinner. Then it puts them together in a single diagram.
You can know exactly how to renew a passport: the form number, the photo rules, the fee, the office, the three-week wait.
Knowing all of it gets you no closer to holding a passport than knowing none of it. Somebody still has to fill the form in, pay, post it, and check three weeks later that it arrived.
That gap is where agency lives, and we cross it so often that we stop noticing it.
Every task splits in two: working out what to do, and then doing it. Knowing is only the first half. Something that can do the first half and nothing else is a reference book.
What makes a person capable rather than merely knowledgeable is a set of plain, unglamorous skills. Picking things up. Keeping track of a half-finished job. Remembering what was said. Going and asking. Looking in the files. Noticing a thin answer. Answering for the result.
An LLM sits at the pure-knowing end. It reads text and produces text. It cannot check anything, reach anything, remember what it decided a minute ago, or change a single thing in the world.
Put plainly: it has no agency until something lets it change the state of a system outside itself. That is the line this half crosses.
Part 1 improved what came out of the LLM by arranging calls into fixed shapes: chains, routes, parallel passes, critics. That was about the thinking. This half does not rearrange the thinking. It adds the capabilities.
A useful test. When an agent disappoints, ask which half is short. If it reasoned badly about information it already had, that is a thinking problem, and Part 1 has the patterns for it. If it answered confidently about something it had no way of knowing, that is a capability problem, and no prompt will fix it. The second case is the common one.
You have offered to organise a dinner for your parents' fortieth anniversary. Twelve people, a Saturday in October, three weeks to do it.
Nothing about it is technical. Yet every capability this half builds will fire before you are done.
You ring the restaurant. Knowing the number was free. The booking needed something outside your own head, and the phone did what you could not.
Nobody wants a paragraph about how lovely your mother is. They want a date, a time, a number of covers, a name, and two allergies, each in its own box, because the next person along works from the boxes.
Table booked, cake not ordered, two replies outstanding. Put it down for an hour and you pick it up in the same place, because you were tracking where you were.
Your sister said "anything but Italian" ten minutes ago. When she says "what about that place on the corner", you already know what is ruled out. Neither of you repeats it, because the last ten minutes are still live between you.
The train times, the restaurant's diary, the balance in your account. None of it is in your head, and all of it changes without telling you, so you ask the systems that own it and take what they say.
"Somewhere near the station with a private room for twelve that is not deafening." No service answers that. You go looking, read a scatter of opinions, ignore the obviously paid ones, and form a view you can point at.
The spreadsheet of who has replied, who is vegetarian, who cannot do before seven. Private, structured, and yours, and you look things up in it rather than rummaging.
The first search gave you nothing but chain pizzerias. Instead of settling, you realise you asked the wrong question, ask a better one, and go again.
Your father hates surprises. Your aunt and uncle have not spoken since 2019. Nobody told you tonight, and nobody needs to, because it is filed under those people and comes out whenever they do.
Not just "did everyone eat", but "was the route sensible" and "was each decision a fair one". A dinner that worked because the one restaurant you rang happened to have a table is luck, not a method.
Nine capabilities across three weeks, plus the discipline that judged them once it was over. You used every one without naming it. The rest of this half names them, because in code each one has to be built on purpose.
Notice how differently they ran in time. Booking the table was one phone call. The argument about Italian food lasted an afternoon. That your father hates surprises, you have known for thirty years.
That spread is why memory comes in three scopes rather than one, and why the scope table below is worth a second look.
You have agency when you can change something outside your own head. That is the whole of it. Before you rang the restaurant there was an intention, and after it there was a table held in your parents' name. Nothing in your head moved the table. The call did.
What is easy to miss is that you were not doing it bare-handed. Take the phone away and you cannot book. Take the spreadsheet away and you lose track of who eats what. Take away the thirty years of knowing your father and you buy him a surprise party he will hate. Take away the person who asks afterwards whether it went well and you never find out that the table was booked for the Friday. Strip all of that off a perfectly capable adult and you are left with somebody who knows exactly how to organise a dinner and cannot organise one.
That kit is a harness. Yours assembled itself over a lifetime, which is why it is invisible to you. An agent has none, so you build its harness deliberately, in code, and the rest of this half is that build. Agency is the thing being granted. The harness is what grants it.
A harness has always meant two things at once. It is what lets a horse pull a cart, and it is what stops a climber hitting the ground. Both meanings apply here, and that is why every chapter ahead spends as long on the fences as on the mechanism. A harness that only enables is not a harness, it is a loose rope.
The nine capabilities fall into four groups. The discipline sits apart, because it is aimed at the other nine rather than standing beside them. Together they are the agent's harness, the machinery you wrap round the LLM.
Acting: the hands
The one door between the LLM and everything else. Nothing in the next group is reachable except through it.
The LLM cannot run anything itself. It writes a structured request naming a function and its arguments, your code runs that function, and the result goes back.
Lesson 10 →Finding out: the senses
Four different outside worlds, all reached through that same door. The last of the four is the ability to go and get more when what came back is not enough.
A request over the network to a live service, with the keys, timeouts and failures that come with touching real systems.
Lesson 14 →For everything nobody has packaged tidily. Retrieve, judge the sources, answer from them, and cite where each claim came from.
Lesson 15 →The private data behind the login, reached by writing precise SQL, fenced so that reading can never turn into destroying.
Lesson 16 →Look at what the search returned, spot what is missing, ask a better question, and search again before committing to an answer. Part 1 reasoned better about what it already had. This goes and gets more.
Lesson 17 →Holding on: the memory
One idea, three scopes. Telling those scopes apart is the single most useful thing on this page.
The working record of one task: what has been said, which tools are pending, which stage comes next. Born empty, thrown away at the end.
Lesson 12 →The turns of one conversation, kept by you and re-sent each time, because the LLM keeps nothing between calls.
Lesson 13 →Facts, episodes and habits about a person, written down deliberately, kept healthy, and wired back into the agent when they return.
Lesson 18 →| Scope | Lives for | Keyed by | Gone when | Typical home |
|---|---|---|---|---|
| State | one task run | nothing, it is handed on | the task finishes | an object in memory |
| Short-term memory | one conversation | a session id | the session ends | a cache or session store |
| Long-term memory | many conversations, indefinitely | a user id | you delete it on purpose | a database or vector store |
State is the odd one out in that third column, and deliberately so. The other two are looked up: the right drawer by session id, the right person's notes by user id. State is never looked up at all, because it is handed from one step to the next inside a single run and then dropped. A thing you retrieve needs a key. A thing you pass along does not.
Handing it back: the shape
The hands change the world. This changes what the world receives.
When the answer feeds code rather than a person, ask for named, typed, validated fields instead of prose.
Lesson 11 →Being answerable: the discipline
Not a capability but a discipline, and the only one aimed at the other nine, which is why the diagram draws it around them.
Three verdicts, written down before the run: did it arrive, was the route sensible, and was each move a proper one.
Lesson 19 →The third verdict is the one people skip, and it is the one that catches quiet failures. Back at the dinner, suppose the confirmation email arrives and the restaurant has you down for twelve covers on the Friday. The agent picked the right tool, filled in every field, and got a clean success back. Nothing failed. The answer even looked right.
Only a check on the individual move catches that. An agent judged solely on whether it produced an answer will pass this run and lose you the table.
This half is not ten separate demonstrations. Each chapter builds one capability by hand, so you see the mechanism, and then packages it into a piece the later chapters reuse. By the end, those pieces have stacked into a single agent rather than a pile of demos.
| Chapter | Builds by hand | Leaves behind | Reused by |
|---|---|---|---|
| 10 | the tool loop | Agent, @tool | 14, 15, 16, 19 |
| 11 | a schema-bound answer | StructuredAgent | 17 |
| 12 | named stages and moves | StateMachine | 13, 18 |
| 13 | re-sending the transcript | ShortTermMemory | 18 |
| 17 | search then re-search | Corpus | your own agents |
| 18 | a notebook on a person | LongTermMemory | your own agents |
| 19 | three verdicts | evaluate, TestCase | your own agents |
The order matters. Hands first (10), because without them nothing else counts. Then the shape of what comes out (11). Then the two kinds of holding on: within one task (12) and across a conversation (13).
Then four chapters of reaching outward, one per world: live services (14), the open web (15), your own database (16), and shelves of documents that need reading properly (17).
Then long-term memory (18), and last comes the discipline drawn around everything (19).
Do not try to decode all of this yet. Nothing below is needed to start Lesson 10, and every box gets a chapter of its own. It is here so you have somewhere to put each capability as you meet it.
The ten are not a shopping list. They arrange themselves: one part reasons, one part runs the loop, some things are held on to, some are reached for, one thing is handed back, and the whole lot is judged from outside.
Everything in the picture below except the decide box is that harness.
Not the LLM, the loop. Decide, act, observe, repeat. The LLM sits in one box of three and never leaves it. Everything else is code you wrote, which is why an agent is built rather than prompted.
Live services, the web, a database, a shelf of documents: four worlds, one mechanism. Each arrives as an ordinary function the LLM may ask for. Learn the door once and every new capability has the same shape.
One task sits inside one conversation, which sits inside everything known about that person. They are not alternatives. Each is read in before the loop runs and written back after.
If a person reads the result, prose is fine. If code, a service, or the next agent reads it, the result is a form with fields. That one decision at the edge is what lets agents be joined together.
The dashed frame is deliberate. Evaluation is not the tenth item on the list. It is drawn around the other nine, because it is the only one pointed at the rest.
Each capability inside the frame is also a new way to be wrong, and the frame is how you find out which one went wrong.
A bigger harness is not a better agent. Giving an agent a hammer does not make it a carpenter. Every capability here widens what the agent can do. None of them makes it more likely to do the right thing. That comes from the instructions, the tool descriptions and the fences, not from the wiring.
Every capability widens the blast radius. A tool that books a table can double-book it. A memory that remembers can hold something false and keep repeating it. A search that grounds an answer can ground it on nonsense. Each one you add is another thing that can fail, cost money, or act on the world when it should not have. That is not an argument against any of them. It is why each chapter spends as long on the fences as on the mechanism.
The LLM still only produces text. Nothing here changes that. A tool call is text asking your code for something. A structured output is text shaped to a schema. A memory is text you chose to keep and re-send. The capability is real, but it lives in your code, and so does the responsibility.