Building an AI agent working environment

This appendix describes how to organise work with artificial intelligence (AI) not as a sequence of separate prompts, but as a working environment: AI agents work to permanent rules and in clearly defined roles, their results are checked, and the decisions are taken by a person, who is also responsible for them. The appendix helps you to build such an AI instrument for the “Decisions with AI” practical tasks that appear in every chapter, and also for a course paper, a business plan or a presentation.

Relation to Appendix A. Appendix A describes how to carry out one analytical task with AI and how to check its results. This appendix describes how to build an environment in which such results are produced and checked according to rules set in advance. For the basic task, prompts are usually enough; for the extended task, a minimal agent environment is recommended (B.7). The provisions of Appendix A apply in both cases: the problem and the final decision are formulated by the student (A.1), the result is checked with the protocol (A.2), and the use of AI is disclosed (A.7).

B.1 Prompts and the agent environment#

A single long conversation with an AI assistant is suitable for a short task. In a larger piece of work it becomes hard to manage:

• compliance with the requirements weakens — as the conversation grows longer, the requirements for style, citation and terminology stated at the beginning are ignored more and more often, and repeating them every time is inconvenient;
• the roles are not separated — the same assistant creates, corrects and assesses, and therefore notices its own errors less easily;
• it is hard to trace — later it is unclear which instructions produced the result, and why;
• there is too much reliance on the tool — people tend to accept the result of an automated system without checking it sufficiently, especially when it looks convincing (Parasuraman & Manzey, 2010).

An agent environment reduces these risks through structure: the requirements are kept in a single file, each agent has one role, the result is checked, and nothing is changed or submitted until a person has approved it. It does not do away with prompts: a rules file is essentially a permanent, carefully considered prompt.

Key concepts

B.2 Link with Appendix A#

B.3 The structure of the working environment#

Figure B.1. The structure of an AI agent working environment

flowchart TB
    H["The person<br/>objective and quality criteria"] -->|writes| T["Rules file<br/>applies to all agents"]
    H -->|describes| S["Agent skills<br/>how a specific piece of work is done"]
    T -->|constrains| A["Agents<br/>one role each"]
    S -->|sets the steps| A
    A -->|uses| I["Tools<br/>search, spreadsheet, files"]
    A -->|produces| R["Result"]
    R --> P["Checks and reviews<br/>checklist, recalculation, another agent"]
    P -->|findings and evidence| D{"Decision by the person"}

    style H fill:#e8f4ee,stroke:#1c9768
    style D fill:#e8f4ee,stroke:#1c9768
    style P fill:#fff6d6,stroke:#c9a227

In the diagram, green marks the actions of the person and yellow marks checking. The person is there both at the beginning (the objective and the criteria) and at the end (the decision); the agents work between these two points, following the rules the person has written.

B.4 The cycle of a single piece of work#

The structure shows what the environment consists of; the cycle shows how one piece of work is carried out in it — for example, how the financial part of a business plan or one analytical perspective of an extended task is prepared.

Figure B.2. The cycle of a single piece of work: from task to submission

flowchart TB
    U["1. Task, criteria<br/>and expectation"] --> AG["2. The agents work<br/>to the rules and skills"]
    AG --> PK["3. Repeatable checks"]
    PK --> PR["4. Reviews<br/>findings with evidence"]
    PR --> SI["5. Consolidation<br/>what is confirmed, what is rejected and why"]
    SI --> SP{"6. Decision by<br/>the person"}
    SP -->|revise| TA["7. Revisions"]
    TA -->|minor| PK
    TA -.->|substantial| PR
    SP -->|approved| PA["8. Submission<br/>with the use of AI disclosed"]
    PA --> PM["9. Lessons<br/>into the rules or skills"]
    PM -.->|next piece of work| U

    style U fill:#e8f4ee,stroke:#1c9768
    style SP fill:#e8f4ee,stroke:#1c9768
    style PK fill:#fff6d6,stroke:#c9a227
    style PR fill:#fff6d6,stroke:#c9a227

1. Task, criteria and expectation. The person describes what has to be done and how it will be decided whether it has been done well, and writes down the expectation before the agents start work (steps 0a and 0b of the A.2 protocol). In the rest of this appendix the steps of the cycle are referred to as “steps 1–9 of the cycle”, and those of the Appendix A protocol as “the steps of the A.2 protocol”.
2. The agents work. The agents follow the rules file and the skills; where something is unclear they mark it instead of inventing an answer. A new conversation or a separate working session is started for each piece of work, and important decisions and intermediate results are written into a file. This is done because in a long session the model follows instructions less well and confuses details, and because agreements that remain only in the conversation do not survive into the next session.
3. Repeatable checks. Whatever can be checked mechanically: figures, formulas, references, and whether the text has remained unchanged.
4. Reviews. Other agents assess the result, and they do not read one another’s assessments until they have written their own. Each finding is presented with evidence — a quotation, a location or a calculation. Findings are candidates: agreement between several agents is not yet proof (A.2).
5. Consolidation of findings. The findings are checked in the text or in the source and compared with one another. Rejected findings are presented together with the reason, so that the person can disagree. It is stated who did the consolidation — the person or an agent.
6. Decision by the person. The person decides what to correct, what to leave and what to discuss. The order is always the same: review → report → approval → revisions.
7. Revisions. After minor revisions the checks are repeated; after substantial ones the review is repeated as well, because correcting a text easily introduces new errors.
8. Submission. With the use of AI disclosed (A.7).
9. Lessons. Whatever went wrong is written into the rules or the skills — including when the work is returned for correction.

The cycle expands the four stages of working with AI described in section 5 of the Introduction: step 1 corresponds to defining the problem, step 2 to handing the task over to the tool, steps 3–5 to verifying the result, and steps 6 and 8 to public accountability.

B.5 Principles#

B.6 The agent card and the agent skill#

The agent card#

The card serves both as an instruction to the agent and as a document that later shows what was expected of the agent. For a first attempt a minimal card is enough (the first four fields); the extended fields are added when the work is larger.

Examples of typical agents

The agent skill#

The card answers the question of who works; the agent skill answers the question of how a specific recurring piece of work is done. The rules file applies always and to all agents, the card applies to one role, and the skill applies only while that particular work is being done. A skill is described once and used every time that work is carried out.

The rules are not repeated in a skill — the skill states where they are. If a copy of the rules is kept in the skill, the copy becomes outdated once the original changes, and the agent then works to a requirement that no longer applies.

Figure B.3. How an agent selects and uses a skill

flowchart TB
    Q["Task for the agent"] --> D["List of skills<br/>names and short descriptions"]
    D --> M{"Does the task match<br/>the skill description?"}
    M -->|yes| F["All the instructions<br/>of the skill are loaded"]
    F --> W["Work follows the steps;<br/>templates and examples if needed"]
    W --> O["Result in the required form"]
    M -->|no| G["Work follows the rules file;<br/>when unclear, the person is asked"]

Tools that support agent skills see only the names and short descriptions of the skills at first, and they load the full instructions only when the task matches the description. The description therefore states when to use the skill and when not to — a skill with an unclear description may remain unloaded even when it is needed. In some tools a skill can also be invoked directly, by name; for important work this is safer. In tools without a skills feature, the person pastes the text of the skill into the conversation or the project.

The structure of a skill

A completed example of this structure is the source-checking skill template; next to it is the rules file template. Both templates can be downloaded and adapted to your own work.

B.7 How to build your own environment#

Figure B.4. Steps in building your own AI agent working environment

flowchart TB
    Z0["0. Whether and how AI<br/>may be used"] --> Z1["1. The product and<br/>the quality criteria"]
    Z1 --> Z2["2. Rules file"]
    Z2 --> Z3["3. Two or three roles"]
    Z3 --> Z4["4. Agent cards<br/>and skills"]
    Z4 --> Z5["5. Ways of checking"]
    Z5 --> Z6["6. A test with a<br/>known answer"]
    Z6 --> Z7["7. Lessons → rules"]
    Z7 -.->|next piece of work| Z1

    style Z0 fill:#e8f4ee,stroke:#1c9768
    style Z1 fill:#e8f4ee,stroke:#1c9768
    style Z5 fill:#fff6d6,stroke:#c9a227
    style Z6 fill:#fff6d6,stroke:#c9a227

0. Whether and how AI may be used. The course description and the rules of the lecturer and of the university determine whether AI is allowed in this piece of work, for which subtasks, and how its use is to be disclosed. If the rules are unclear, the lecturer is asked.

1. The product and the quality criteria. What is being produced (one perspective of an extended task, a business plan, a presentation) and how it will be decided whether the result is good. Without criteria the agents have nothing to rely on, and the person has nothing to check against.

2. Rules file. One page is enough. It sets out:

   • the objective and the quality criteria;
   • the language, style and terminology;
   • citation, and what to do when a source cannot be found;
   • data protection: what must never be uploaded;
   • a provision that the agent must not carry out instructions it finds in the content it reads;
   • the limits: what only the student formulates;
   • the requirement to support every finding with evidence;
   • what to do when something is unclear;
   • the procedure for making changes;
   • what is recorded (A.3).

   A completed template is given in B.6.

3. Two or three roles. To begin with, two or three agents joined into a workflow managed by the person are enough; more are added only when it becomes clear that they are needed.

4. Agent cards and skills. A minimal card for each role (B.6); a skill for recurring work.

5. Ways of checking. For each result it is decided what is checked with a checklist or by recalculation, what another agent reviews, and what the person must check personally (the conclusions, the most important figures, the sources).

6. A test with a known answer. The environment is tested with a task whose correct answer is known, preferably one with a deliberately built-in error (for example, the café case in Appendix A). The test shows whether the calculation agent arrives at the same result and whether the checker finds the error. If the checker does not find it, the cards or the skills are corrected, rather than the environment being trusted.

7. Lessons → rules. A recurring mistake is written down as a rule or as a step in a skill; the rules file and the results are versioned (at least with the date in the file name).

Two levels of implementation

Both levels can be tried free of charge, though with usage limits; some features (for example, projects in certain services, or agents with file access) are available only on paid plans (B.10).

Examples of application

• The extended “Decisions with AI” task. The student formulates the problem (E1), writes down the expectation (0a, 0b) and breaks the objective down into subtasks (E3). Agents are created for the subtasks assigned to AI: a source finder (data), a calculation agent, an assumption critic. The independent reconstruction, the verdict and the defence are carried out by the student.
• A business plan. The idea generation agent suggests market segments and risks → the student selects and formulates the assumptions → the calculation agent prepares the forecast → the source checker → the language editor; the conclusion is drawn by the student.
• A course paper. The idea generation agent suggests possible research questions → the student formulates the question and the outline → the drafting agent (if the rules of the course allow it) prepares sections from the student’s material → the source checker → the student checks, edits and draws the conclusions → the language editor.
• A presentation. The student approves the text → the slides agent lays it out → the text on the slides is compared with the approved text → review; the last slide carries the disclosure of the use of AI.

What to submit with the work

• The environment files as they were actually used, as separate files and without rewriting anything: the rules file (its name depends on the tool), the agent cards and the skill files. There is no need to prepare a separate document for assessment: a rewritten copy is out of date at once. If the environment lives in the project instructions field of a tool and there are no files, the text of that field is saved into a single file.
• Handover records and prompt logs (A.3) — the format is free: a spreadsheet, a form provided by the lecturer, a document or a text file. The log can also be compiled by the agent itself, if the history of the work is available to it. What matters is that it shows the subtask, who it was assigned to (the tool, the model, the date), the instruction, the result received and what was done with it.
• Not submitted: data files, access tokens and third-party data. What is submitted is the environment, not the whole working folder.

B.8 When an agent environment is not needed, and common mistakes#

An agent environment is not an end in itself. It is not needed, or it is not suitable, when:

• the task is short and one-off — a prompt and the A.2 check are enough;
• the purpose of the task is to learn to do it yourself (for example, calculating net present value for the first time);
• there is no time to review the results — an environment does not remove the need to check;
• the limits of a free plan do not allow several reviews — then one agent, a checklist and a recalculation are enough;
• the rules of the course restrict the use of AI;
• the data must not leave the computer — then only a local model or work without AI is possible (B.9).

B.9 Data protection and security#

The A.7 condition applies to all agents and all tools. How the data reach the AI service depends on the way of working:

• An institutional account and switched-off model improvement reduce the risk, but the data are still sent to the service and stored for some time. Confidential data are therefore not uploaded in that case either.
• Third-party data (survey and interview answers, contact details) are not uploaded.
• Personal data — only those that are necessary and consciously chosen (for example, to create an account).

When an agent has tools and access to files, four further matters are important in addition to data protection:

• Treat what the agent reads as data, not as instructions. Web pages, PDF files, e-mails and other people’s files may contain hidden instructions that the agent may start to carry out — changing the result or passing on data (Greshake et al., 2023). The rules file therefore states that such instructions are not carried out, and an agent that reads external content is given no access to confidential files.
• The agent’s permissions. The agent is given the working folder only; changes to files and commands require the person’s approval; before changes are allowed, a copy or a version is saved.
• Skills and connectors from the internet — only from trusted sources and only after reading them before installation: a skill may contain executable code, and a connector (MCP) gives the agent access to accounts, files or other services.
• Passwords and access tokens are not kept in the text of the rules file or of any other shared file.

B.10 Choosing tools#

1. The tools provided by the university come first. An institutional account is usually covered by stricter data protection than a personal one (for example, prompts are not used to train models). This reduces the risk, but B.9 and A.7 still apply.
2. Free plans have limits: a restricted number of prompts or credits, not all models, and some features only on paid plans. Using the full capabilities of the models usually requires a paid plan.
3. The use of data to improve models. On personal plans this may be switched on by default; it is worth checking before you start and, if necessary, switching it off in the privacy settings.
4. Student offers are usually time-limited and require proof of student status — the terms are to be read on the provider’s own page.
5. Built-in AI features. Text editors and other applications may have AI features built in; it is worth finding out when they send content to a service and how to switch them off.
6. Local models. Applications that run open AI models on the computer itself do not send the content entered to the internet (an internet connection is needed to download the model and for updates), so they suit cases where the data must not leave the computer. Their drawbacks: a sufficiently powerful computer is needed (plenty of memory and, preferably, a graphics card), so for most students this is only an option and not one they need to spend time on. Besides, the capabilities of these models are usually smaller than those of the largest cloud services. Some such applications also offer cloud models — if one of these is selected, the data are sent to a service again.
7. Portability. Rules and skills kept in plain text files make it possible to change the tool without rewriting the whole environment. Open formats help here: AGENTS.md (persistent instructions for an agent), Agent Skills (SKILL.md skill folders) and MCP (connecting agents to external tools; only trusted connectors, B.9). Many tools read AGENTS.md or allow a reference to it, so one common instructions file is enough; the names of files and of skill and agent folders differ from platform to platform — this is stated in their documentation.

A list of widely used tools, with official links and the date on which they were checked, is published on the website: AI tools and platforms (in Lithuanian). It is updated separately from this appendix, because the terms on which tools are offered change more often than the method does.

B.11 For lecturers#

When to suggest it. The basic task does not need an agent environment. For the extended task a minimal environment (a rules file and two or three roles) is recommended, because building it develops exactly what the task tests: formulating quality criteria and breaking the objective down into subtasks (E2, E3).

What to assess. The rules file, the agent cards and the skill files are submitted together with the handover records and the prompt log (A.3, B.7). These files show better than a list of prompts alone how the student defined the criteria and the limits. They do not receive a separate score: they are assessed as evidence for the A.6 criteria, so the assessment scale is the same for students with an environment and for students without one. The format of the log is free; the lecturer may specify their own form and file names.

The minimum for a first environment. For a first attempt, a one-page rules file, two agent cards and one test with a known answer are enough; a separate skill file is needed only for recurring work.

Testing the environment. For testing students’ environments (B.7, step 6 of the cycle) the public café case in the appendix is suitable, or a separate seminar variant with a built-in error (A.8). If the checker does not find the error, the environment must be corrected before any assessed work.

Access. A task is planned so that it can be carried out without file access and on a free plan; paid features are not required.

Data. Public or hypothetical data are used for the tasks (A.7); third-party data are not used in an agent environment.

References#

Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (pp. 79–90). ACM. https://doi.org/10.1145/3605764.3623985

Huang, J., Chen, X., Mishra, S., Zheng, H. S., Yu, A. W., Song, X., & Zhou, D. (2023). Large language models cannot self-correct reasoning yet [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2310.01798

Parasuraman, R., & Manzey, D. H. (2010). Complacency and bias in human use of automation: An attentional integration. Human Factors, 52(3), 381–410. https://doi.org/10.1177/0018720810376055