Summary
Two near-identical invoices arrive in two workspaces that must not see each other’s context, and the right behaviour differs because of what lives outside the instruction. That sets the requirement: an agent invocation must assemble context that is both relevant to the task and permitted for this actor, do the work, check the result, return schema-conforming output, and leave reviewable evidence. Each Agent node has a static contract — input schema, output schema, task definition, execution settings — which is what lets the rest of the workflow treat the agent as a node rather than a conversation.
Before the first model call, a cognitive layer assembles the agent definition, applicable guidelines, relevant skills, prior learnings, organizational and workspace context, the workflow’s structure from the Work Knowledge Graph, and the node’s model assignment; the emphasised word is permitted, since selection filters on relevance and permission together rather than searching everything the platform knows. The invocation then runs as a loop — context construction, completion, tools, temporary state, judging, output formation — where the judge turns a model response into a node output by checking against guidelines and task requirements, though it can only check specified conditions and cannot guarantee correctness.
The article is candid that the invoice is untrusted input: permission to call a tool comes from the actor’s scope rather than from instructions in the document, but no mechanism here makes a model immune to embedded instructions.
It then separates four easily conflated terms — memory, skill, guideline and learning — by what they are and how fast they change, notes that caching is a performance mechanism and not knowledge at all, and insists that a raw trace is not a learning asset: review and evaluation stand between output and future behaviour, precisely so a bad extraction cannot reinforce itself.