Teaching / Course 03
Agentic Engineering
From tool calling and MCP to governed, testable agent systems
How to take an AI agent that works in a demo and give it permissions, tests, an audit trail and a stop button — so you can let it near a real system.
A software-engineering course for moving beyond prompt demos and vibe-coded prototypes toward typed tools, durable workflows, security controls, evaluations and auditable governance.
- 3 days · 21 contact hours
- AI and software engineers, architects, security specialists and technical product owners.
- One agent is progressively extended with tools, MCP, state, approvals, tests, security and governance evidence.
- A governed research or operations agent with typed contracts, an MCP server, evaluation and red-team evidence.
Feasible when one primary Python stack is used and multi-agent systems remain a design exercise. Building several unrelated agents or comparing every framework hands-on would not fit.
Outcomes
What a participant can do afterwards.
- Distinguish chatbots, deterministic workflows, tool-using agents and multi-agent systems and select the simplest suitable architecture.
- Explain the responsibilities of an agent harness: instructions, context, tools, state, control loop, permissions, budgets, validation and observability.
- Build typed tools with preconditions, postconditions, invariants, explicit errors and approval requirements.
- Package a reusable skill and explain progressive disclosure, versioning, provenance and skill security.
- Build and consume an MCP server using the current stateless 2026-07-28 specification concepts for tools, resources and prompts.
- Add state, checkpoints, retries, idempotency, human-in-the-loop gates and safe termination to an agent workflow.
- Move beyond vibe coding through specifications, tests, static analysis, CI, sandboxes, dependency controls and reviewable changes.
- Evaluate complete trajectories and map technical evidence to NIST AI RMF, ISO/IEC 42001, the EU AI Act and OWASP agentic risks.
Depth
Realistic depth within three days.
The difference between these three columns is the difference between a course description and a course. Everything in the third column is real content — it is simply not something anyone builds from scratch in 21 hours.
Implemented
Written by participants, from scratch or near it.
- Typed agent and tool contracts
- Local MCP server and client
- Evaluation and approval workflow
Practised
Run, tuned and measured against prepared scaffolding.
- State, checkpoints and idempotency
- Security tests and trajectory analysis
- Governance and operational evidence
Surveyed
Explained and demonstrated. Not built in three days.
- Large multi-agent platforms
- Enterprise certification programmes
- Provider-specific agent products and deployment clouds
Day 1
Harnesses, tool contracts, skills and MCP
Build a constrained single agent before adding orchestration complexity.
-
Architecture baseline
Chatbot, workflow and agent distinctions; the autonomy spectrum; when conventional software is the better answer.
-
Harness engineering
Model, instructions, context, tools, state, control loop, policies, budgets, stop conditions, errors and observations.
-
Tool calling and contracts
JSON schemas, typed dependencies, preconditions, postconditions, invariants, error types, timeouts, retries and result validation.
-
Permissions and approvals
Read versus write tools, least privilege, capability grants, confirmation, compensation and side-effect boundaries.
-
Skills
Reusable procedures, manifests, supporting files, progressive loading, versioning, provenance and malicious-skill risks.
-
MCP architecture
Hosts, clients and servers; tools, resources and prompts; the current stateless request model, metadata, caching and authorization concerns.
-
Lab 1 — typed agent and MCP
Build a small typed agent, create read-only and side-effecting tools, expose a local MCP server and require approval for writes.
A constrained single agent with typed tools, explicit errors, a local MCP server, a permission matrix and an approval gate.
Day 2
Durable orchestration and beyond vibe coding
Make execution explicit, resumable and maintainable.
-
Recap and trace review
Inspect Day 1 traces and identify ambiguous tool descriptions, malformed arguments and unsafe side effects.
-
Agent and workflow patterns
ReAct, router, planner-executor, evaluator-optimizer, supervisor-worker and deterministic workflow boundaries.
-
State, context and memory
Conversation state, workflow state, long-term memory, context selection, data lifetimes, poisoning and deletion policies.
-
Durable execution
Checkpoints, resumability, retries, idempotency, compensation, human interrupts and failure recovery.
-
Multi-agent trade-offs
Specialization, handoffs, shared state, communication overhead, coordination failure and when not to use multiple agents.
-
Beyond vibe coding
Requirements, repository structure, architecture decisions, unit and integration tests, static analysis, CI, dependency pinning and sandboxed execution.
-
Lab 2 — productionize the agent
Add explicit state, checkpoints, idempotency, retries, human review and tests to a deliberately fragile starter implementation.
A restartable, testable agent workflow with explicit state, failure handling, review gates and a maintainable repository structure.
Day 3
Security, evaluation, governance and deployment
Prove what the agent can do, constrain what it may do and document how it is governed.
-
Threat modelling
Assets, identities, trust boundaries and data flows; goal hijacking, prompt injection, tool misuse, privilege abuse and memory poisoning.
-
Guardrails and validation
Input, tool-call, tool-result, output and trajectory validation; sandboxing and safe failure.
-
Agent evaluation lab
Task success, tool selection, argument correctness, side-effect correctness, trajectory efficiency, robustness and adversarial cases.
-
Governance evidence
System inventory, intended purpose, ownership, risk classification, approvals, monitoring, changes, incidents and human oversight.
-
Standards and regulation
NIST AI RMF, ISO/IEC 42001 and 23894, EU AI Act responsibilities and the OWASP Top 10 for Agentic Applications.
-
Operations and deployment
Secrets, workload identity, network policy, observability, budgets, model routing, rollback and incident response.
-
Capstone red team
Attack another team's agent, remediate findings and finish the technical and governance evidence package.
-
Demonstrations and review
Demonstrate controlled behaviour, evidence, unresolved risks and a deployment recommendation.
A governed agent prototype with evaluation evidence, security traces, risk register, tool inventory and deployment recommendation.
Labs
Four deliverables, each one the input to the next.
- Contracts and MCP Typed agent, safe tools, local MCP server, permission matrix and human approval.
- Durable orchestration Explicit state, checkpoints, retries, idempotency, review gates and repository tests.
- Evaluation and red team Trajectory dataset, task and tool metrics, adversarial cases and remediation evidence.
- Governed capstone Operational agent, risk register, tool/data inventory, trace evidence and deployment decision.
Capstone specification
- Documented intended purpose, users, exclusions and autonomy boundary.
- At least three typed tools with explicit errors and separate read/write permissions.
- At least one reusable skill and one MCP server or MCP-exposed capability.
- State, maximum-step and cost budgets, safe termination and resumability.
- Human approval for sensitive actions and idempotency for side effects.
- A minimum 20-case trajectory evaluation set with normal, failure and adversarial scenarios.
- Trace collection, tool and data inventory, risk register and incident/rollback procedure.
- A deployment recommendation: approve, approve with conditions or do not deploy.
Stack
The tools, and why each one is in the room.
- PydanticAI Typed dependencies, tool schemas, output validation, approvals, MCP integration and evaluation-friendly design.
- Official MCP SDK / FastMCP Builds a standards-based server and exposes protocol concepts directly.
- LangGraph Makes deterministic and model-driven steps explicit and supports persistence and human interrupts.
- OpenTelemetry-compatible tracing Vendor-neutral traces for models, tools, workflows, latency, costs and errors.
- pytest + typed fixtures Validates deterministic code, contracts, tool results and regression scenarios.
- Sandbox + explicit allow-lists Separates model decisions from credentials, network access and side effects.
Discussed, not taught hands-on
- OpenAI Agents SDK is discussed for managed turns, tools, handoffs, guardrails, sessions and built-in tracing.
- Microsoft Agent Framework is discussed for enterprise workflows, typed executors, state management and explicit multi-agent orchestration.
- PydanticAI graph and durable-execution integrations can replace LangGraph; the learning objective is explicit state and recovery semantics, not one framework.
- Crew-style multi-agent frameworks are not the default because coordination complexity obscures contracts, security and evaluation.
Logistics
Who it is for, and what it needs.
- Software and AI engineers, solution architects, technical product owners, platform engineers, security specialists and governance practitioners who build or review agentic applications.
- Python, APIs, JSON schemas, Git and basic LLM prompting. Familiarity with asynchronous code and testing is helpful. Course 1 or equivalent LLM application experience is recommended.
- 12–20 participants per instructor; a teaching assistant above 16, or when participants have limited software-testing experience.
-
- One capstone codebase for all three days; every new concept improves the same system.
- PydanticAI and the official MCP/FastMCP tooling for core labs, with LangGraph introduced only for explicit durable orchestration.
- OpenAI Agents SDK and Microsoft Agent Framework are framework comparisons, not additional participant implementations.
- Mock tools and synthetic data; no workshop agent receives production credentials or unrestricted external side effects.
- One multi-agent pattern is taught as a paper or whiteboard design exercise. Single-agent reliability is the practical priority.
- A deliberately fragile starter agent is provided so participants focus on engineering controls rather than UI and boilerplate.
The workshop produces a governed prototype and evidence package. It does not constitute legal advice, ISO/IEC 42001 certification, a penetration test or approval for autonomous production operation.
Book a training
Tell me which course and roughly when. You get a reply from me, not a sales sequence — dates, a quote, and an honest answer if the course is a poor fit for what your team actually needs.