Best Practices for Building AI Agents
Vendor-neutral best practices for building AI agents, checked against Anthropic's engineering guidance on agents, tools and context, the MCP specification's security best practices and the OWASP Top 10 for Agentic Applications. It covers choosing between workflows and agents, designing tools, managing context and memory, running a reliable agent loop, securing agents and MCP servers, and evaluating agent behaviour.
6
Sefism · Oct 2026
24
Sefism · Oct 2026
8
Sefism · Oct 2026
AI
Sefism · Oct 2026
Best practices
AI & Machine Learning
Sefism
18 min read
Intermediate
Free
What this best practices guide is
Vendor-neutral best practices for building AI agents, checked against Anthropic's engineering guidance on agents, tools and context, the MCP specification's security best practices and the OWASP Top 10 for Agentic Applications. It covers choosing between workflows and agents, designing tools, managing context and memory, running a reliable agent loop, securing agents and MCP servers, and evaluating agent behaviour.
It has 6 chapters and 24 practices, each with why it matters, what to do and what to avoid. For developers building agents with LLM APIs.
Chapter by chapter
1. Choosing between a workflow and an agent (4 practices)
Agents trade cost and predictability for flexibility. These practices help you pick the simplest design that solves the problem.
2. Designing tools an agent can use well (4 practices)
Anthropic calls the tool layer the agent-computer interface and recommends investing in it as much as in a human interface. These practices make tools easy to choose and hard to misuse.
3. Context, memory and long-running tasks (4 practices)
An agent's context fills with every tool result it reads, and quality drops as it fills. These practices keep the context focused across long tasks.
4. Running a reliable agent loop (4 practices)
An agent is a loop of model calls and tool calls. These practices make the loop stop at the right time, recover from errors and keep people in control of risky steps.
5. Agent security, identity and MCP (4 practices)
Agents act with real credentials on content they did not write. These practices follow the OWASP Top 10 for Agentic Applications and the MCP security best practices.
6. Evaluating and observing agents (4 practices)
An agent can reach the right result by many paths, and the same task can pass once and fail the next time. These practices make agent quality measurable.
How it works on Sefism
The guide reads like a short course: a syllabus, then one chapter per page in a focused reader, with a quiz at the end of each chapter for members. The opening chapters are open to everyone. Adding it to your account uses credits, opens every chapter and keeps your progress.
Every claim is checked against the sources listed on the page (8 cited).
Ready to start?
Opens on Sefism in a new tab.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
Follow along
New writing, resources and project ideas land here first.