An agent's action space is the fixed set of things it's actually allowed to do — usually tool calls, plus the special "produce a final answer" action. The LLM doesn't invent new capabilities; it selects from what's been made available to it.
The Action Space Is Defined by the Developer, Not the Model
Available actions for this agent:
- search_knowledge_base(query: string)
- get_order_status(order_id: string)
- escalate_to_human(reason: string)
- final_answer(text: string)
The LLM can only choose among these four — it cannot invent a
fifth action that wasn't defined, no matter how it's prompted.This is a genuine safety property: an agent's worst-case behavior is bounded by what actions actually exist for it to choose from, not by whatever the model might otherwise "want" to do.
Designing a Good Action Space
| Principle | Why It Matters |
|---|---|
| Narrow, well-defined actions | Easier for the model to select correctly, easier to validate and secure |
| Clear, distinct purposes | Overlapping actions increase the chance the model picks the wrong one |
| Explicit escalation/failure actions | Gives the agent a defined way to stop instead of forcing a guess when it's uncertain or stuck |
| Least privilege | Only include actions the agent genuinely needs for its task — see Least-Privilege Agents |
Practical Use Case
A support agent's action space might deliberately exclude a direct "delete_account" action, replacing it with "flag_for_account_deletion_review" — the action space itself is a safety control, not just a functionality list.
Common Mistakes
- Giving an agent a broad, generic action (like an unrestricted "run_sql(query: string)") when a narrower, purpose-specific action would be safer and easier to validate
- Omitting an explicit "I don't know" or "escalate" action, forcing the model to always attempt something even when it shouldn't
- Designing overlapping actions with unclear boundaries, increasing the odds of the model picking a plausible-but-wrong one
Interview Relevance
"How does the action space affect agent safety?" — the key insight: an agent literally cannot take an action that isn't in its defined action space, making the action space itself a genuine security boundary, not just an API surface.
Practice Question
Design the action space (list of named actions, not code) for an HR agent that answers policy questions and can escalate sensitive requests, but should never directly modify payroll data.
