Building AI agents from parts
An AI agent is software that can take a task and see it through, using the tools it has been given.
It can be built from separate parts, with a model at the centre and tools, data and other agents around it. This page explains the open standards that join those parts together, and the UK guidance on running them safely.
What an AI agent is
The UK Government's AI Playbook describes agentic AI as systems that make decisions and take actions with little human input. An agent works out which tools and functions it has, and uses them to reach its goal.
The playbook gives the example of an order system. One agent gathers prices. When an order comes in, the system can ask another agent to fetch a newer price if the stored one is out of date. Each agent has a clear job, and the system knows which agent can do each task.
Connecting an agent to its tools
The Model Context Protocol (MCP) is an open standard for connecting AI applications to data, tools and workflows. Its makers compare it to a USB-C port, a standard plug that lets you build a connection once and use it in many places.
In MCP, the AI application is the host. It connects to servers, and each server can offer three kinds of thing. Resources are data for the model or the user. Prompts are templates for messages and workflows. Tools are functions the model can run.
Connecting agents to each other
The Agent2Agent protocol (A2A) is an open standard for agents to talk to other agents. It works across agents built with different frameworks by different companies. Agents can work together without sharing their memory, tools or internal logic.
Google first developed A2A and gave it to the Linux Foundation. The project's own guidance puts it this way. Teams use MCP to give an agent its tools, and A2A to let that agent work with other agents.
Giving each part only what it needs
The OWASP Gen AI Security Project prefers small, specific tools to open-ended ones. It advises keeping each tool to the functions its job needs. An agent that summarises email only needs to read it, so its tool should have no way to send or delete messages.
The same goes for permissions. A tool that looks up products needs read access to the products table and nothing more. For actions with a big effect, such as posting on someone's behalf, OWASP advises asking a person to approve each one first.
The MCP specification takes the same line. It asks for a user's clear consent before any tool runs. It also asks hosts to treat a tool's own description as untrusted unless it comes from a trusted server.
Security from design to day-to-day running
The National Cyber Security Centre (NCSC) published guidelines for secure AI system development in November 2023. They follow four stages, from secure design and development to secure deployment and operation. The guidelines are aimed mainly at teams building on models hosted by another organisation, or reached through another provider's API.
The AI Playbook's fourth principle asks for meaningful human control at the right stages.
Personal data
For agents that handle personal data, the Information Commissioner's Office (ICO) publishes guidance on AI and data protection, including a risk toolkit for AI projects.