The series teach a domain front to back. Patterns are for when you already have a problem and need the decision, not the lesson. Together, they organize the engineering decisions that cut across MCP, RAG, and AI Agents, and point back into the series for deeper reasoning and implementation.
Choose the simplest execution model that can complete the task reliably.
Open pattern ↓Choose the simplest execution model that can complete the task reliably. A single call answers a bounded question. A workflow runs fixed steps in a known order. An agent decides its own next step in a loop. The deciding question is who chooses what happens next: you, or the model.
Reach for an agent only when the path genuinely cannot be known in advance. Many production tasks are workflows wearing an agent costume.
Avoid the agent loop for anything a workflow can express. Autonomy you do not need is blast radius you did not have to accept.
The choice is structural, made before any prompt: the architecture caps what can go wrong, the prompt only shapes behavior within it.
An agent that loops, re-decides, and burns budget on a task that was always a straight line.
Decide what is actually missing: knowledge, context, or behavior.
Open pattern ↓Decide what is actually missing. RAG when the model lacks knowledge it could look up. Long context when the knowledge is small enough to hand over whole. Fine-tuning when the behavior itself must change, not the facts. Often, "the model is wrong" means the system supplied the wrong knowledge, not that the model needs more training.
Default to retrieval for facts that change or are too large to inline. Reserve fine-tuning for form, format, and consistent behavior that prompting cannot hold.
Avoid fine-tuning to teach facts that a retrieval step would supply more cheaply and keep current. Avoid long context as a substitute for retrieval when the corpus outgrows the window.
Knowledge that changes lives outside the weights, where it can be updated and audited.
A fine-tuned model that is confidently out of date, or a context window stuffed past the point of useful attention.
Separate connection identity from the authority to read, call, and commit.
Open pattern ↓Separate connection identity from the authority to read data, call tools, and commit actions. Authentication confirms who is making the request. It says nothing about what that request should be allowed to do once it is inside. A perfectly authenticated agent can still be permitted to reach tools and data it has no business touching.
Apply this at every tool and data boundary an agent or MCP client can reach, especially where a single credential currently grants more than the task needs.
Avoid overengineering fine-grained authorization for public, read-only capabilities with no sensitive scope. The separation still matters, but the policy may be simple.
Authorization lives in the application and the tool layer, not in the prompt and not in the fact of a valid connection.
"It authenticated, so it is allowed" — a verified identity treated as a permission slip.
Treat content returned by tools as untrusted data, not as a command.
Open pattern ↓Treat content returned by tools as untrusted data unless the application has explicitly defined a structured control channel as authoritative. Content from MCP servers, connectors, retrieval systems, files, and web searches all flows into the context the model reasons over. A connector you trust can still hand back a document carrying an injected instruction. An audited connector is not the same as audited data.
Apply to every source that feeds the context, not just the user's message. This is the pattern that joins all three series: MCP supplies the tools, RAG supplies retrieved content, the agent acts on both.
Never exempt a source because it is internal, audited, or "ours." Provenance of the channel is not provenance of the content.
The boundary is which content the model may treat as authoritative, enforced outside the model. The answer is almost never "all of it."
The agent follows an instruction that arrived inside a retrieved document or tool result, and does the wrong thing while reporting success.
Separate proposal, commitment, and verification of a consequential action.
Open pattern ↓Separate proposal, commitment, and verification. Before a consequential or irreversible action, validate the intended effect through a dry run, preview, policy evaluation, sandbox, or explicit approval. After execution, re-read authoritative state before marking the action complete. A safe plan and a successful response are not proof that the world changed as intended.
Apply wherever an action is hard to undo or expensive to get wrong: refunds, deletes, sends, writes to systems of record. The two checks scale with consequence, so the highest-stakes actions earn both a pre-commit validation and a post-commit verification.
Do not gate read-only, harmless, or trivially reversible operations. Friction spent there erodes attention you need for the actions that matter.
Both checks belong in the tool contract: a pre-commit validation path and a post-commit verification path. A 200 OK is not proof.
A clean success in the log for an action that never actually took effect, or took the wrong effect.
Find the stage that failed before reaching for a bigger model.
Open pattern ↓When a RAG answer is wrong, find the stage that failed before reaching for a bigger model. The failure could be in ingestion (the fact never made it in), retrieval (the right chunk was not returned), context construction (it was returned but crowded out), or generation (everything was present and the model still missed). Each stage has a different fix. A bigger model may help with generation or context use, but it cannot repair evidence that was never ingested or retrieved.
Apply on every "the model got it wrong" report against a retrieval system, before any model or prompt change.
Skip the staged diagnosis only when there is no retrieval in the path at all.
The trace has to show what was retrieved and what was placed in context, so the failing stage is visible rather than guessed.
Teams upgrading the model or rewriting the prompt to fix a problem that was actually a missing or mis-ranked chunk.
Each card is a decision distilled from the deeper writing. When you need the full reasoning and the implementation, read the series it draws on.