Introduction to Agentic AI and AI Agents · Section 4 · Notes

Notes: Check How AI Uses Company Data (RAG, APIs and MCP)

Read a lecture instead of watching it, then make each idea yours.

Arun Nagarathanam · 29 Oct 2026 Notes · 10 of 10 in this course

Lecture 4.0

Which Part of This Request Needs a File, Live Data or Your Approval?

Three questions about one customer email will carry us through the whole section, and by the end you can ask them of any seller's AI product.

Key ideas

01A document: Which shop rule would allow a cancellation?
02A live record: What would the assistant need to find out about order 24 right now?
03Your permission: Which action would you want to approve before it happened?

The request. A customer writes to your online shop: Please cancel order 24. I no longer need it. You want an AI assistant to help with it.

Before it can help, the assistant has to answer three questions:

Which shop rule would allow a cancellation?
What is true about order 24 right now?
Which action do you want to approve before it happens?

By the end of the section you can explain how the assistant finds a rule, gets current order information, and acts only with the access you allow.

Lecture 4.1

How Does AI Answer From Company Files?

An assistant can find the right policy even when your question uses different words from the document. Here is how it does that, and how to test it.

Key ideas

01Knowledge base: The policies, handbooks and guidance the company chooses to let the assistant search, with current versions marked and sensitive documents restricted.
02Embedding: A list of numbers a model makes for each passage. Passages with related meanings sit near each other, like positions on a map.
03Vector database: Stores those lists, keeps them linked to the original text, and searches them for close matches when a question arrives.
04RAG: Retrieval-augmented generation: finding information and using it to write an answer.

The vacation days question. Priya manages HR at a retailer. An employee asks about unused vacation days, while the policy says annual leave, so a search for the exact words could miss it. Searching by meaning finds it.

From question to answer, the steps are:

The documents are split into passages, such as a paragraph or a few paragraphs about one subject.
A model trained to compare meanings turns each passage into an embedding.
A vector database stores the embeddings linked to the original text.
The question gets its own list of numbers and the closest passages are retrieved.
Those passages go to the answering model with the question as context.

Not only vectors. Some RAG systems use keyword search, or combine several search methods.

Your test. Ask the assistant to show the policy passage beside its answer, and test it first with a question whose answer you already know.

Make it yours

Freelancer or consultant

Your input
Your own contract templates or client guidelines.

Ask AI
Answer only from these files and show the passage you used.

Check
Ask one question whose answer you already know.
Small business owner

Your input
Your shop's returns and cancellation rules.

Ask AI
Answer from these rules and show the matching passage.

Check
The passage shown is the current version of the rule.
On a team at work

Your input
The HR or process documents your team keeps.

Ask AI
Answer from the approved policies and show the passage beside the answer.

Check
Test with a question your team can already answer.

Lecture 4.2

Does Sharing a File Train the AI?

Giving an assistant a file and training a model are different things. The promise that matters most covers where the file is kept and who can open it.

Key ideas

01Training: Happens while a model is developed: examples are used to adjust how it responds, and those changes shape its later answers.
02Context: Supplying Maya's contract gives the model the clause for this one answer and does not by itself carry out training.
03Retention period: The length of time a service keeps information.
04Separate decision: A provider may use submitted material in a later training process depending on its terms and settings. Saving the file in her account is another decision again.

Maya's contract. Maya, a purchasing manager, wants to check whether a signed contract allows a supplier's price increase, and the prices are confidential. Saving the file in her account so she can ask again tomorrow does not train the model either. The file stays stored information the assistant can supply again.

So a promise that we do not use your data for training answers only part of her concern. She also needs to know:

Where the file and conversation are kept.
Who can open them.
When they will be deleted.

Account type matters. Business account terms can differ from individual ones, and a company administrator may control some settings.

Check the chain. If another company provides the model behind the assistant, the contract passage may go to that company too. Find out which services receive it and what each one does with it.

Make it yours

Freelancer or consultant

Your input
A client contract or a price list.

Ask AI
Find the provider's terms for your type of account.

Check
Where it is kept, who can open it and when it is deleted.
Small business owner

Your input
A signed supplier contract.

Ask AI
Check the clause on price increases.

Check
Which services receive the passage.
On a team at work

Your input
A confidential document your team wants to use.

Ask AI
Ask your administrator which settings control sharing and training.

Check
Business account terms, not only the individual ones.

Lecture 4.3

How Do AI Agents Connect to Apps?

A contract says when an invoice was due. Only the accounting system says whether the money arrived this morning, and a connection is how the assistant gets that answer.

Key ideas

01Function calling: The model asking to run a function, here the invoice lookup, with the number 104.
02API: How the function asks the accounting system for the record.
03MCP: Model Context Protocol: the shared rules between the program offering a tool (an MCP server) and the connecting part inside the application (an MCP client).
04Permission is separate: MCP does not create the record or grant access. Permission to read an invoice's status is separate from permission to change it, cancel it or issue money.

Daniel asks whether invoice 104 has been paid. The path is:

His application offers the model a tool called get invoice status and says it needs an invoice number.
The model asks to run that function with the number 104.
The application checks the request: an available tool, the required information, the intended accounting account.
It runs the function, which asks the accounting system through its existing API.
The record comes back.

Failures travel back too. If the invoice does not exist, the connection has expired or the system is down, the application should return that failure. Otherwise the model may write a confident reply with no record behind it.

Why MCP exists. When several AI applications need the same tool, shared rules help.

The builder still sets access. The builder connects the correct account and gives the tool only the permissions it needs.

Make it yours

Freelancer or consultant

Your input
An invoicing or booking tool you use.

Ask AI
Check the status of one invoice.

Check
A failure is reported, not covered with a confident reply.
Small business owner

Your input
Your order or payment system.

Ask AI
Look up one record by its number.

Check
The tool can read but not change the record.
On a team at work

Your input
A system your team shares, such as accounting.

Ask AI
Ask the builder what each tool is allowed to do.

Check
Reading, changing and cancelling are separate permissions.

Lecture 4.4

How Do You Test an AI Agent?

A demonstration with questions chosen in advance shows very little. A set of saved questions you can run again after every change shows a lot more.

Key ideas

01Evaluation (eval): A repeatable test used to judge how a system performs.
02Prompt injection: An attempt to redirect an AI system through material it reads.
03Keep failed cases: Run every saved case again when the search, instructions, model or tool connection changes, to see what improved and what broke.
04A first exercise: Twenty questions is a manageable start for Priya, not a standard for every AI system. Passing them does not prove every future question will work.

Priya starts with 20 real staff questions her team can check, including 3 difficult cases:

A current policy that was never added to the searchable files.
2 policy versions that conflict.
A question with no approved rule at all.

Record what passes. Before each run she records the source that should support the answer, and the expected answer or an acceptable request for help. If a policy is missing, saying so and asking HR passes, and inventing an answer fails.

Test injection safely. Priya adds a harmless instruction line to a test copy of a policy. If the assistant can read private records or send messages, include those actions in the tests, with fictional records and a destination the company controls, and check that blocked actions stay blocked.

A real case. EchoLeak, a historical case from 2025, showed that a crafted email could make Microsoft 365 Copilot disclose information from its working context, with no link clicked and no attachment opened. Microsoft patched it before it was publicly disclosed.

Make it yours

Freelancer or consultant

Your input
Questions from your own clients that you can answer.

Ask AI
Save them with the expected answer and source.

Check
Run them again after any change.
Small business owner

Your input
Real customer questions, including one with no approved rule.

Ask AI
Record what a pass looks like for each.

Check
A missing rule gets a request for help, not an invented answer.
On a team at work

Your input
20 real questions your team can check.

Ask AI
Include 3 difficult cases and keep every failure.

Check
Blocked actions stay blocked in a test copy.

Lecture 4.5

What Changes AI Answers?

Some settings change the wording while an answer is written, and others change what the model has learned. Neither one checks that a statement is true.

Key ideas

01Temperature: Changes how strongly the likely choices are favoured. Lower usually favours them more, and higher gives less likely choices a better chance.
02Top-p: Changes which group of choices is considered. Lowering it usually narrows the group, and raising it allows a wider one.
03Parameters: The numerical values learned during training, working together to shape how the model handles text.
04Fine-tuning: Training an existing model further with selected examples, such as replies the company has approved.

Why wording varies. Thanks for getting in touch and Thank you for your message both do the job. The model writes in small pieces called tokens. At each step it works out how likely each possible next piece is, then one is selected.

Both settings act during writing. Temperature and top-p affect selection while the answer is being written. Neither checks whether a statement in the reply is true.

Before fine-tuning:

Try clear instructions and examples first.
Test new replies afterwards.
Remember a model trained on your style still needs current information to answer a question about an order.

Lecture 4.6

What Do AI Builders Use?

Running an AI workflow involves a place to run it, a way to build it and someone who keeps it working. Maya's Monday supplier-price report shows all three.

Key ideas

01Cloud: Computing and storage rented from a provider over the internet. It gives the workflow a place to run while Maya's laptop is closed.
02Framework: A structured collection of reusable software components that connect models, tools and the rest of an application. LangChain and CrewAI are examples.
03Visual workflow tools: n8n, Zapier and Make let a builder arrange and connect the steps on one screen.
04Deployment: Making software available where people or scheduled jobs will use it, with its settings and connections.

What the cloud does not do. It does not decide what the workflow does or make the supplier connections reliable.

Ways to build. With prices arriving through an API, a spreadsheet and an unusual review rule, a builder may write custom software for that logic. A visual workflow can hold fixed steps, a step where a model chooses an action, custom code, or all three. Claude Code or Codex can help a builder produce custom software from a clear description of the inputs, rules, result and checks.

After deployment, someone still has to:

Provide access to the supplier sources.
Receive the failure notice.
Pay the running cost.
Repair a connection when a supplier changes its API, spreadsheet or website.

A useful failure notice names the affected source.

Make it yours

Freelancer or consultant

Your input
A report you produce every week.

Ask AI
Describe the inputs, rules, result and checks.

Check
Who receives the failure notice.
Small business owner

Your input
A Monday supplier-price report.

Ask AI
Work out where it runs while your laptop is closed.

Check
The failure notice names the affected source.
On a team at work

Your input
A workflow your team wants running on a schedule.

Ask AI
List who provides access, pays the cost and repairs connections.

Check
A silent failure on one source still produces a notice.

Lecture 4.7

Can You Tell What an AI Product Really Does?

Two sellers can describe the same product in very different ways. Giving both the same request shows what each one actually finishes.

Key ideas

01Name the work: Our assistant checks orders and prepares replies for you to approve names work you can examine. Our AI agent handles customer support does not.
02Rule and status: A knowledge base can supply the cancellation rule, and a tool connected to the order system can look up order 24's current status.
03A draft is not an action: A drafted reply has not cancelled the order. Cancelling needs a cancellation tool and permission to use it.
04Evidence: A message saying done is weaker evidence than the updated order.

The shop rule. Your shop allows cancellation while an order is still waiting to be dispatched. The assistant needs the rule and whether order 24 has been dispatched, and the rule alone cannot tell it the second.

Ask each seller:

How those steps are chosen: does the model decide to look them up, or does a fixed workflow follow them?
What happens when a request needs an extra step.
To demonstrate with a test order.

Separate permissions. Reading the order, cancelling it and sending a reply are separate actions. Your shop might allow lookups while requiring your approval for cancellations.

Finish with proof. If a seller promises to cancel after your approval, approve the test action and check that the order's status changes.

Make it yours

Freelancer or consultant

Your input
A tool you are thinking of paying for.

Ask AI
Ask the seller to demonstrate a real request.

Check
The record changed, not only a done message.
Small business owner

Your input
Order 24 or a similar test order.

Ask AI
Give each seller the same cancellation request.

Check
The order's status changes after you approve.
On a team at work

Your input
A support product you are comparing.

Ask AI
Ask which actions need approval.

Check
Reading, cancelling and replying are allowed separately.

Lecture 4.8

What Can You Now Check About Any AI Product?

You can now say what an AI product reads, what it changes and what it leaves for a person. Order 24 puts each part in its place.

Key ideas

01The rule: Cancellation is allowed before dispatch. It comes from a searched knowledge base, which is the RAG part.
02The live status: A connected tool requests it through an API. MCP can give compatible applications a common way to offer and call such tools.
03The proof: The order record stays the source for whether the cancellation actually happened.

If order 24 has not been dispatched, the assistant can prepare a reply. Cancelling still needs its own tool, permission and any approval the shop requires.

Three more questions belong to the same system:

How long it keeps customer information (retention).
Whether it handles known test cases (an eval).
Whether instructions inside a message or document could redirect it (prompt injection).

Quick reference

Finding a rule

Knowledge base	The policies, handbooks and guidance the assistant may search.
Embedding	A list of numbers that stands for the meaning of a passage.
Vector database	Stores embeddings linked to their text and finds close matches.
RAG	Retrieval-augmented generation: finding information and using it to write an answer.

Getting live data and acting

Function calling	The model asks to run a function, such as get invoice status, with an input like 104.
API	How a function asks another system for a record.
MCP	Model Context Protocol: shared rules for offering and calling tools.
Permission	Reading, changing, cancelling and issuing money are separate permissions.

Trusting it

Retention period	How long a service keeps information.
Eval	A repeatable test used to judge how a system performs.
Prompt injection	An attempt to redirect an AI system through material it reads.
Temperature and top-p	Settings that change wording while an answer is written; they do not check truth.

Building and running

Cloud	Computing and storage rented over the internet.
Framework	Reusable software components that connect models, tools and the rest of an application.
Deployment	Making software available where people or scheduled jobs will use it.
Fine-tuning	Training an existing model further with selected examples.