# agentage.wiki

> Practical, community knowledge base on AI agents: step-by-step guides on permissions, human oversight, prompt injection, MCP, testing and auditing.

Practical knowledge base on AI agents (in preparation). Editorial standards: https://agentage.org/

## Guides

### What is an AI agent?

An AI agent is a language model that works toward a goal in a loop: it plans, calls tools, reads the results and decides the next step.

1. Name the goal: what should be true when the agent is done?
2. List the tools it may call (search, files, email, APIs) and nothing more.
3. Run the loop: plan → act with a tool → read the result → decide again.
4. Stop on a clear condition: goal reached, step limit hit or a human must decide.

### How to give an agent only the permissions it needs

Least privilege limits the damage when an agent misunderstands a task or reads a malicious instruction.

1. Write down the actions the task really requires.
2. Create a separate account or API key for the agent, with only those rights.
3. Prefer read-only access; grant write access per task, not forever.
4. Keep secrets out of prompts; let a secret manager inject them.
5. Review and revoke the permissions when the task ends.

### How to keep a human in the loop for irreversible actions

Sending, paying, deleting and publishing cannot be undone. Route them through a person.

1. Mark the irreversible actions in your tool list.
2. Make the agent prepare the action and show a preview: recipient, amount, content.
3. Require an explicit approval for each one; approval does not carry over to the next.
4. Log who approved what and when.

### How to defend an agent against prompt injection

Text the agent reads from web pages, emails or files can contain instructions. Treat it as data, never as commands.

1. Separate instructions (from the user) from content (from tools) in your design.
2. Do not let tool output trigger sensitive actions without confirmation.
3. Allow-list the domains and recipients the agent may contact.
4. Test with planted instructions in documents before going live.

### How to set step and cost limits on an agent loop

An agent without limits can loop, repeat work and spend money. Guardrails make a demo production-ready.

1. Set a maximum number of steps per task.
2. Set a budget: tokens or money per task and per day.
3. Define the termination conditions in advance, including "ask a human".
4. Alert when a limit is hit and keep the partial result.

### How to connect an agent to tools with MCP

The Model Context Protocol (MCP) is an open standard that lets AI applications connect to tools and data sources through a common interface.

1. Pick an MCP server for the system you need (files, database, ticketing, search).
2. Register the server in your agent client configuration.
3. Review which tools the server exposes and disable the ones you do not need.
4. Test each tool with harmless inputs and check the logs.

### How to test an agent before you trust it

An agent is only as good as its behaviour on your real tasks, including the hard and the adversarial ones.

1. Collect 20–50 real tasks with known good outcomes.
2. Add edge cases: missing data, ambiguous requests, planted instructions.
3. Run each task several times; agents are not deterministic.
4. Score outcome, cost, steps and safety violations separately.
5. Re-run the set after every model or prompt change.

### How to log and audit what an agent did

If you cannot reconstruct what the agent did, you cannot fix it or answer for it.

1. Log every tool call with inputs, outputs and timestamps.
2. Store the prompt and model version used for each run.
3. Keep human approvals in the same log.
4. Review a sample of runs every week, not only the failures.

## Agent data sheet fields

- Name & version: What the agent is called and which release this sheet describes.
- Maker: Who builds and answers for it, with contact.
- Models: Which language models it runs on.
- Tools & permissions: What it can read, write, send or pay.
- Data handling: What data it stores, where, for how long.
- Human oversight: Which actions need a person's approval.
- Known limits: Tasks it should not be used for, known failure modes.
- Test results: Results under the public Agentage protocol, with date.

## Agentage test

- Public protocol: Test tasks, scoring and environment are published before any test runs.
- Own environment only: Tests run in sandboxes and accounts we control. We never attack anyone's live service.
- Maker sees it first: The maker receives the results 7–14 days before publication and can respond.
- Right of reply & retest: The maker's response is published with the results; fixed versions can be retested.
- Nothing for sale: Listings and rankings cannot be bought. No sponsored placement.

## Questions

### What is agentage.wiki?

agentage.wiki is a practical, community knowledge base about AI agents, in preparation. It publishes short question-and-answer pages and step-by-step guides on building, controlling, testing and auditing agents. Contributions are open; an editor reviews every page before publication.

### Can AI agent makers publish their own data sheet?

Yes. Makers will be able to publish a standard data sheet: models, tools and permissions, data handling, human oversight, known limits and test results. The sheet is factual and the same for everyone; listings cannot be bought.

### What is the Agentage test?

The Agentage test is an independent evaluation of AI agents under a public protocol. Tests run only in environments Agentage controls, never against someone else's live service. The maker sees the results 7–14 days before publication and can respond; the response is published with the results.

### Who is behind agentage.wiki?

agentage.wiki is founded by Zoltán Varga, a Budapest-based AI ecosystem architect and AI visibility researcher who builds research pipelines, knowledge bases and AI agents. Agentage editorial standards are published on agentage.org.

### How can I contribute a guide?

Contributions open with the launch. Each guide answers one practical question in numbered steps, cites its sources and passes editorial review before it goes live. Until then, proposals can be sent through the contact page on vargazoltan.ai.


## Founder

- Zoltán Varga — AI ecosystem architect and AI visibility researcher, Budapest: https://vargazoltan.ai/
- ORCID: https://orcid.org/0009-0003-1020-834X
- arXiv: https://arxiv.org/a/varga_z_1.html

## Articles

- [Human Approval for Irreversible Agent Actions](https://agentage.wiki/articles/human-approval-for-agent-actions/): To make an AI agent ask a human before sending, paying, or deleting, you must classify actions by their reversibility and implement a hard stop before execution. The agent should present a structured preview of the specific data and consequences, requiring explicit authorization for each distinct event. This process shifts the system from a passive click-through habit to a meaningful human-in-command control model.
- [Defending AI Agents Against Prompt Injection](https://agentage.wiki/articles/prompt-injection-defense-for-agents/): Protect AI agents by strictly separating system instructions from user data and treating all external inputs as untrusted data rather than commands. Implement gates for sensitive actions like sending emails or accessing keys, and regularly test defenses by planting hidden instructions in documents and web pages.
- [Agent Loop Limits: Iteration, Cost and Termination Checklist](https://agentage.wiki/articles/agent-loop-limits-checklist/): Every AI agent loop requires a hard iteration cap, a defined token and monetary budget, and explicit termination conditions before deployment. Without these first-class primitives, systems risk runaway loops, uncontrolled spending, and context overflow that turn prototypes into financial liabilities.
- [Connecting Agents to Tools: MCP, Direct APIs, or CLI?](https://agentage.wiki/articles/mcp-tools-governance-first/): Your choice of interface depends primarily on permission and audit requirements, not on token costs. Model Context Protocol (MCP) offers standardized access control and discovery, while direct APIs and command-line tools require custom governance layers. Select the interface that satisfies your trust boundaries first, then optimize for efficiency among compliant options.
- [Evaluating AI Agents: Building a Test Set That Means Something](https://agentage.wiki/articles/how-to-evaluate-ai-agents/): To test an AI agent properly, you must build an evaluation set from real user queries and specific edge cases, then run the agent repeatedly to measure non-deterministic variance. Watching logs or observing runs does not prove correctness; you need a structured scorecard that tracks outcomes, costs, and safety violations against a known ground truth.
- [Logging and Auditing AI Agents: What to Record for Reconstruction](https://agentage.wiki/articles/agent-logging-audit-checklist/): To audit an AI agent, you must record the specific tool calls with their inputs and outputs, the exact prompts and model versions used, and any human approvals or guardrail interventions. A complete audit trail also requires checkpointing intermediate workflow states and tracking token accounting to reconstruct the full context and cost of every execution.
- [Single Agent or Multi-Agent? Decide by Task Structure](https://agentage.wiki/articles/single-agent-vs-multi-agent/): A multi-agent system beats a single agent only when the task is decomposable into independent parallel parts, yielding up to 90% performance gains in specific benchmarks. Conversely, for sequential tasks where steps depend on previous outputs, adding agents increases overhead and degrades performance by 39% to 70%. The decision relies on analyzing task structure rather than assuming more agents always mean better results.
- [Writing Subagent Briefs and the Artifact Return Pattern](https://agentage.wiki/articles/subagent-delegation-brief/): To prevent work duplication, an orchestrator must delegate with a contract containing four elements: a specific goal, a strict output format, explicit tool guidance, and hard boundaries on what to exclude. The subagent should not return raw text but write results to an external file and return a reference containing a versioned schema, provenance data, and a summary of evidence.
- [Independent Agent Testing and Responsible Disclosure: FAQ](https://agentage.wiki/articles/independent-agent-testing-disclosure-faq/): Test AI agents only within your own isolated environment using simulated data to prevent real-world damage. Define a strict red-teaming scope that excludes production systems and third-party accounts. Allow the developer a reasonable period to fix the issue before disclosing the flaw publicly.
- [When Verification Steps in Agent Pipelines Pay Off](https://agentage.wiki/articles/verification-steps-in-agent-pipelines/): Adding a verification step pays off when it targets critical outputs in high-value tasks, reducing factual errors by up to 28% in specific benchmarks. Place the verifier after independent data gathering or before irreversible actions, not after every minor step. Prove the gain by running parallel A/B tests with and without the verifier on a fixed set of ground-truth queries.
- [The AI Agent Data Sheet: Fields and What They Mean](https://agentage.wiki/articles/ai-agent-data-sheet/): An effective AI agent data sheet must explicitly list the underlying model version, the specific tools and permissions granted, data handling protocols, and documented human oversight points. It also requires a record of known failure modes and recent test results with dates to prove the agent operates within defined safety boundaries.