Design a safe read-only research agent

Research is a useful first agent task because it can operate without messages, payments or account changes. “Read-only” still needs source, privacy, injection and budget controls.

Allow only read tools

The agent controls lab filters an authored tool catalogue.

from agent_cases import research_agent_case

result = research_agent_case()
assert result["enabled"] == ["search_approved_corpus", "open_source"]
assert result["write_tools_enabled"] is False
assert result["maximum_sources"] == 5
assert result["citation_required"] is True
assert result["external_side_effects"] == 0

The save_external tool remains disabled. The simulation performs no search or network call.

Bound the task

Define allowed domains/corpora, maximum sources/pages/time/cost and required output schema. Preserve source dates and citations. Route current or high-impact claims to approved authoritative sources and surface conflicts.

Treat pages and retrieved documents as untrusted content. They cannot change instructions or enable tools. Avoid collecting unnecessary personal data and minimize traces.

Evaluate research quality

Use questions with labelled sources, stale conflicts, missing evidence and injection. Score source eligibility, coverage, citation support, synthesis accuracy and abstention. Also grade trajectory: duplicate searches and ignored limits matter.

The Generative & Agentic AI course uses read-only research before adding write-capable workflows.

Exercise

Implement a read-only agent over a local corpus. Set five-source and time caps, inject indirect instructions and demonstrate cited output plus an abstention without any write capability.

Continue learning

This article is part of the Agent workflows and state sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Prevent a retrieved document from authorizing tool use.
• Continue with Build a support triage workflow with an escalation path.

Reference: NIST Generative AI Profile.