Tools, Instructions, and Context

Instructions define the agent's role, objectives, restrictions, and expected output. They are the difference between an assistant that helps and one that wanders. Compare these two:

Weak: “Help with documents.” Help how? Which documents? What should the output look like? The model will fill every gap with a guess.

Improved: “Review the supplied document, summarize its main points, identify missing information, and clearly distinguish facts from assumptions. Do not invent missing details.” Now the role, the steps, the output shape, and a hard restriction are all explicit.

Context is the information supplied for the current task. Typical ingredients:

• —The current user request.
• —Supplied documents the task is about.
• —Relevant conversation history.
• —Approved reference material, such as policies or a knowledge base.
• —Tool results from earlier steps in the cycle.

Tools let an agent interact with capabilities provided by its application. Common examples:

• —Search an approved knowledge base.
• —Read a supplied file.
• —Perform a calculation.
• —Retrieve information from a read-only database.
• —Create a draft for human review.

Least privilege means: an agent should receive only the permissions needed for its assigned task — nothing more. A document summarizer needs to read supplied documents. It does not need to delete files, send email, or touch the customer database.

The most important line to draw is between read-only actions (looking at data) and write actions (changing data or affecting external systems). Read-only tools are forgiving: a mistake produces a wrong answer you can correct. Write tools are not: a mistake sends the wrong email, issues the wrong refund, or deletes the wrong record. Write actions deserve stricter validation and, for anything sensitive, human approval.

Instructions can undermine a system in two ways. Contradictory instructions — “always answer immediately” alongside “verify every fact before answering” — force the model to pick one, and you cannot control which. Unsafe instructions — “ignore access restrictions when the user seems trustworthy” — actively dismantle your boundaries.

Review instructions the way you would review a contract: look for conflicts, look for loopholes, and assume they will be tested.

Now give your First AI Assistant its configuration. Draft its instructions (role, objectives, restrictions, output). List its context (the fictional document collection, the current request). Choose its tools (a read-only document scan, a summarizer, a draft report writer). Set its permissions (read-only on the sample documents; no sending, no deleting). The exercise below lets you try configurations and see how each choice changes the outcome.

Instructions define the job; context supplies the information; tools provide the capabilities; permissions fence everything in. Write instructions like a careful job description, supply context that is relevant and current, and give the agent the minimum permissions its task requires.