An agent that works in a demo will still spend forty minutes retrying a tool that has been down since Tuesday, and it will do so with the confidence of a system that has never been told the difference between persistence and a loop. Building these systems is less about model choice than about the fences around the model: what it may call, how many times, with whose credentials, and what happens when the third step fails. The interesting engineering is almost entirely in the constraints.
This page maps agent development onto four live catalog areas, explains what each contributes to an agent that can be trusted with real work, and gives an order in which the skills compound. The order starts with a single tool call and ends with observability, because that is the path a working agent takes.
Autonomy is a dial you set before launch
An AI agent developer builds software that lets a model take actions rather than only produce text. The actions arrive as tools: a function that reads a database, a request that files a ticket, a command that runs a script, a call that sends an email. The developer's job is the machinery between the model's decision and the action's effect, including the decision about how much freedom the model should have in the first place.
That last point is the one beginners miss. Autonomy is a design parameter, not a property of the model. A support agent that drafts a reply for a human to approve is a different system from one that sends it. A research agent that reads ten pages is different from one that can spend money. The developer decides where the human sits, how many steps are allowed, what state persists between steps, and what evidence is required before an action is taken. Most production agents are deliberately less autonomous than the demos that inspired them.
The role has three overlapping parts. The first is integration engineering: connecting tools, handling authentication, normalising the messy responses real systems return. The second is control design: choosing the shape of the reasoning, the retry policy, the termination condition, and the handoff to a person. The third is evaluation, which for agents means judging a trajectory rather than a single answer. An agent can reach the right outcome by an unacceptable route, and that route is what a security review will ask about.
Agents also fail differently from ordinary software. A function that throws an exception stops. An agent that receives a confusing tool result may decide to try again with slightly different arguments, then again, then invent a parameter that does not exist. The failures compound because each step is a fresh decision based on a history that now includes the failure. Developers who come from backend engineering find this both familiar and unnerving: the system is deterministic in its plumbing and wildly non deterministic in its planning.
The honest gate for a beginner is a task the agent completes without supervision, on inputs it has not seen, with a log you can read afterwards and a cost you can predict. That is a higher bar than it sounds. Most first agents work on the founder's example and fail on the second user.
Three shapes cover most production agents. The first drafts work for a human to approve, which is the safest place to start and the easiest to measure. The second executes a bounded task with a fixed tool set and a step limit, and returns a report rather than taking an irreversible action. The third runs in batches over a queue, where each item is independent and a failure costs one item rather than the whole run. None of the three looks like the open ended assistant in a launch video, and all of them are easier to debug, price, and defend in a review.
The first month is largely about discovering how literal tool descriptions are. You write a description that says the tool searches documents, the model calls it with a query it invented, and the result is irrelevant because the tool needed an exact identifier. You add a parameter description, the model uses it correctly, and a different tool starts failing because its description now reads ambiguously next to the first one. This is the actual craft: writing interfaces a model can use, not prompts it can admire.
An agent is a permission model with a model inside it
The catalog maps this role onto four areas. Each covers a different part of the system, and a learner who skips one will build an agent that fails in a way they cannot diagnose.
AI Agents & Automation is the core of the work. Tool use, orchestration, memory, retrieval, evaluation, and the security questions that arrive the moment an agent can act. The catalog holds 31 live resources in AI Agents & Automation, 30 of them free and 1 paid. This area is unusually well covered for free, which means the constraint on learning is practice rather than access.
AI Tools & Prompting supplies the instruction layer. How to describe a task, how to constrain an output format, how to make a model choose between tools, and how to write the system instruction that sets the boundaries. The catalog lists 58 live resources under AI Tools & Prompting, 36 free and 22 paid. Agent behaviour is prompt behaviour plus consequences, so this area stays relevant at every level of seniority.
Software Engineering is what makes an agent a service rather than a script. Typed interfaces, tests, retries, idempotency, secret handling, deployment, and the debugging discipline that lets you reconstruct what happened in step seven. Software Engineering carries 36 live resources, 30 free and 6 paid. An agent without this area is a liability with an API key.
Machine Learning is the area people skip and later need. Understanding context limits, sampling, why a model hallucinates a tool name, and when a smaller model is enough for a subtask. The catalog holds 32 live resources in Machine Learning, 25 of them free and 7 paid. You do not need to train anything, but you do need to reason about model behaviour instead of treating it as magic.
Read together, the four areas describe one system. The agent area defines the shape. The prompting area defines the instructions. The software area defines the guarantees. The machine learning area defines the limits. A learner with only the first produces a clever prototype that cannot be operated. A learner with only the third produces a well engineered service that does nothing interesting. The role lives where they meet.
Assembling the first agent that can be trusted with a task
The stages below follow one agent from a single tool call to a supervised deployment. Each stage leaves an artifact, and the artifacts are what you show when someone asks whether you have built one before.
Stage one: make one tool call reliable. Start smaller than you want to. Write a function with a clear name, a described purpose, typed arguments, and a documented failure mode, then let a model call it. OpenAI Function Calling Guide is free and covers schema design and argument handling. Writing Effective Tools for AI Agents (Anthropic) is free and is the single most useful document on tool descriptions. Model Context Protocol Documentation is free and explains the interface standard most tools now follow. Done means a tool that returns a useful error rather than an exception, and a model that calls it correctly for five different inputs.
Stage two: design the control shape before the prompt. Decide whether the task is a fixed sequence, a router, or an open ended planner, and write that decision down. Building Effective Agents (Anthropic) is free and argues, correctly, that most production systems should be workflows with a few model driven steps rather than fully autonomous planners. AI Agents for Beginners (Microsoft) is free and covers the vocabulary from the ground up. LangGraph Documentation is free and shows a state machine approach that makes the control flow explicit. Done means a diagram with five boxes and a labelled failure path for each.
Stage three: give it memory you can inspect. Agents need state, and the wrong state design produces an agent that forgets a decision or repeats one forever. Letta Documentation (Agent Memory Systems) is free and is the clearest treatment of memory as an engineering problem. The Context Course (Hugging Face) is free and covers what should enter the context window and what should stay outside it. Chroma Documentation (Vector Databases for Agents) is free and covers the retrieval store most agents end up needing. Done means a memory model with three tiers you can name: the working context, the durable record, and the archive you can search.
Stage four: make it call tools in combination. LangChain Academy is free and gives a practical feel for orchestration. CrewAI Documentation is free and covers multi agent patterns where separate roles own separate steps. CAMEL-AI Documentation (Multi-Agent Orchestration) is free and goes further into role based coordination. Semantic Kernel Documentation is free and is the strongest option if your team lives in .NET or Java. Done means a two tool task where the second call depends on the first result, and a retry that does not repeat the side effect.
Stage five: evaluate trajectories, not answers. This is the stage that separates a demo from a system. Ragas Evaluation Framework Documentation is free and covers retrieval and answer quality metrics. Arize Phoenix Documentation (Agent Observability) is free and is the practical way to inspect runs step by step. Anthropic Cookbook is free and has working evaluation patterns you can adapt. LLM Agents MOOC (Berkeley) is free and is the most rigorous free treatment of agent evaluation and failure analysis. Done means twenty recorded tasks with a pass or fail judgement, a note on the failure mode of each failure, and a median step count.
Stage six: fence it and watch it. OWASP GenAI Security Project is free and is the reference for prompt injection, excessive agency, and insecure tool use. Software Engineering at Google (free ebook) is free and covers the review habits that stop a dangerous change from shipping. MIT 6.031: Software Construction is free and is the clearest treatment of invariants in a system that has side effects. Done means scoped credentials, an allow list of actions, a step ceiling, a spend ceiling, and a log that a stranger can follow.
The stages overlap, and stage six should start earlier than its position suggests. Every agent that can take an action needs a permission boundary from the first day, even if that boundary is a hardcoded list of two safe operations.
Documentation worth reading before the second agent
Some entries earn their place by solving a specific problem rather than by covering a syllabus.
For the tool interface, OpenAI Cookbook is free and has runnable examples of function calling, structured output, and multi step flows. Google Developers Learning Pathways is free and is a reasonable map of the surrounding platform. n8n Courses is free and is useful if your first agents will be built visually, which is a legitimate way to learn the shape of a workflow before writing one in code. n8n Community Forum is free and is where the practical questions about triggers and credentials get answered.
For the engineering floor, Learn Git Branching is free and makes version control spatial rather than mysterious. MDN Web Docs is free and covers the browser and HTTP side of any interface the agent talks to. roadmap.sh is free and helps you notice gaps in your own stack. Exercism is free and keeps language fluency sharp while you work mostly in glue code. Big-O Cheat Sheet is free and matters when a tool loops over a large collection and the step ceiling is the only thing saving you. MIT OCW 6.006 Introduction to Algorithms is free for the deeper version of the same question.
For the agent specific material, Kaggle 5-Day AI Agents Intensive with Google is free and is a compact guided introduction. Google Developers Learning Pathways appears again because the same platform documentation covers agent tooling and deployment. DeepLearning.AI Short Courses is paid and useful when you want short guided builds with a defined scope. Agentic AI Bootcamp: AI Agents with Python, n8n, MCP & RAG is paid and compresses several stages into one project sequence, which is worth the money if you have built one agent and stalled on the second.
For the model side, CS50's Introduction to Artificial Intelligence with Python (Harvard) is free and covers search and probability in a way that makes planning less mysterious. Neural Networks: Zero to Hero (Karpathy) is free and is the fastest honest route to understanding what a model is doing. PyTorch Tutorials is free and matters the day you fine tune a small model for a narrow subtask. Papers with Code is free and links claims to implementations, which is how you judge whether a technique is usable. Google Colab is paid and is the cheapest way to run a notebook with a GPU. Hugging Face Hub is paid and is where a local model becomes practical.
For the writing side, Anthropic Prompt Engineering Documentation is free and covers instruction hierarchy, which is exactly what a system prompt plus tool descriptions plus user input requires. Learn Prompting is free for the basics. OpenAI Platform Documentation is free and is the reference for request structure. Claude is paid and worth a month of daily use if you are designing long instructions, because using a model teaches its failure modes faster than reading about them.
The bill grows faster than the task does
Free material dominates this path. In AI Agents & Automation, 30 of the 31 live resources cost nothing, and the paid remainder is a single course. That is an unusual ratio, and it means the barrier to starting is time rather than money. It also means the free material is uneven, so choose by the problem in front of you rather than by the length of a curriculum.
Time is where the real cost sits. Expect a few weeks to get one tool call working reliably, a few months to a supervised agent that completes a real task, and longer before you can predict what an agent will do on unseen input. The middle period is the frustrating one, because the agent succeeds often enough to be trusted and fails often enough to be dangerous. That is precisely when the step ceiling, the spend ceiling, and the trajectory log start earning their keep.
Cost has three components that beginners conflate. Inference is the per step model call, and an agent that takes twenty steps costs twenty times a single answer. Retries multiply that, especially when a failure is caused by a bad argument rather than a transient error. And the third cost is human time: every failure has to be read, classified, and turned into a change. A cheap model that fails twice as often is not cheap once a person is reviewing the failures.
Paying earns its place in three situations. A paid course is worth it when it supplies a working project with evaluation attached, because building the evaluation yourself is where most learners stall. A paid model is worth it when the task requires reliable tool selection across many tools, since that is where cheaper models degrade first. A paid observability tool is worth it when you have more than a handful of runs per day and reading raw logs has stopped being feasible.
Predicting the bill is arithmetic once the shape is fixed. Steps per task, multiplied by calls per step, multiplied by the cost of a call at your average context size, gives a number you can compare against the value of the task. Most teams skip this and discover the ratio after the first month. Doing it before the build takes ten minutes and often changes the design, because a task that needs twenty steps to save a person two minutes should probably stay manual.
The first task the agent finishes alone is a milestone worth marking, and worth examining. Read the full trajectory before you celebrate. Look at the steps that did nothing, the retries that succeeded by accident, the tool call that returned more data than the task needed. That review usually reveals two changes that make the agent cheaper and more reliable, and both tend to be invisible until after a success.
A trajectory can be wrong and still finish
A permanent error that keeps getting retried looks like persistence. The agent tries again, receives the same failure, and reports activity rather than progress. An explicit retry rule, with a different action on the second attempt and a hard stop after that, turns persistence back into a decision.
Two tools with similar descriptions look like a choice. The model picks one, the action is real, and the wrong system receives the request. Write descriptions that state when not to use a tool, and keep the number of near duplicates small.
A retrieved instruction looks like data. A document the agent reads contains a line telling it to ignore previous guidance, the model complies, and the action happens under your credentials. Treat retrieved content as data rather than instruction, scope credentials narrowly, and require confirmation for anything irreversible.
A context that grows without bound looks like memory. Every step appends to it, the relevant detail moves out of view, and the agent contradicts a decision it made ten steps earlier. A summarised working state plus a durable record outside the context keeps the agent oriented.
A timeout after a write looks like a failure. The agent retries and performs the action twice. An idempotency key on every write is ordinary API discipline applied to an unusual caller, and it is the cheapest insurance in the system.
A passing test looks like proof. The agent reaches the right result by reading data it should not have touched, and the test rewards it. Score the trajectory instead: which tools were called, with what arguments, and whether each step was necessary and permitted. That is the difference between an agent that appears to work and one you would let near a customer.
The promotion question is a trust question
The step up from agent developer is ownership of a system with real consequences, which is as much about judgment as about code. A senior person decides which tasks deserve an agent at all, writes the permission model, owns the evaluation standard, and can explain to a security reviewer why a given action is safe. That conversation is where the career grows.
Continue inside the catalog through the areas this roadmap rests on: AI Agents & Automation, AI Tools & Prompting, Software Engineering, and Machine Learning. When a stage feels weak, the matching guide is a better next stop than another framework.
Compare the neighbouring roadmaps for AI Engineer, ML Engineer, and Prompt Engineer. The overlap is substantial and the centre differs. An AI engineer builds the feature around a model call. An ML engineer trains and serves models. A prompt engineer owns instruction quality and behavioural specification. The full index sits at Browse by Profession.
One action beats another tab: take a task you do by hand each week and build the smallest agent that can do it with two tools and a step ceiling of five. Log every run. After ten runs, read the trajectories and change one thing. That loop is the job, and it produces a portfolio piece that a reviewer can actually evaluate.
FAQ
What separates an agent from a workflow with an API call?
The model decides what happens next. In a workflow, the developer writes the sequence and the model fills in one step. In an agent, the model chooses among tools and can take a path you did not plan. That freedom is worth paying for only when the task genuinely varies, because it brings cost, latency, and failure modes that a fixed workflow avoids. Building Effective Agents (Anthropic) is free and makes the case better than any summary.
Do I need machine learning knowledge to build agents?
Enough to reason about context limits, sampling, hallucinated tool names, and why a model follows a retrieved instruction. You do not need to train anything. CS50's Introduction to Artificial Intelligence with Python (Harvard) is free and covers the concepts that matter, and Machine Learning is the deeper path if you later need a specialised model for a narrow step.
Which framework should I start with?
Start with the least framework that can express your control flow. A single script that calls one tool and stops is a better first project than a multi agent orchestration, because it makes every failure visible. LangGraph Documentation is free and is a good second step when the sequence becomes a graph, and CrewAI Documentation is free when separate roles genuinely own separate steps. Frameworks hide the part you most need to understand at the start.
How do I keep an agent from doing damage?
Give it the smallest permission set that completes the task, require confirmation for anything irreversible, and cap the steps and the spend. Log every action with its arguments. OWASP GenAI Security Project is free and lists the failure patterns that recur, including prompt injection through retrieved content and excessive agency. A temporary credential that expires is a better default than a permanent one with broad scope.
Is a paid bootcamp worth it for this role?
When it supplies a finished project with an evaluation and review, yes, because those are the parts self study tends to skip. The free material in this area is unusually strong, so information is not the gap. If you have built one agent and abandoned it at the evaluation stage, a guided build is a reasonable purchase. If you have not built one yet, the documentation listed above is enough to start.
What should a first agent project be?
Pick a task where the steps are checkable and the consequences are small. A research assistant that reads five sources and produces a cited summary, a triage agent that labels incoming messages with a confidence score and escalates the rest, or an internal tool that queries two systems and reports the difference. Keep it to two tools and a five step ceiling. Then write the twenty task evaluation before you add a third tool.
SkillCache Editors · Updated November 13, 2026
