What Agentic AI Means for Software Testers
How planning, tools, memory, permissions, and repeated actions change the QA model for systems that do more than generate text.
Key takeaways
- The trajectory and side effects matter as much as the final answer.
- Every tool boundary needs argument, permission, and trust checks.
- Safe recovery must account for actions that may already have happened.
An agent is a stateful workflow
An agent interprets a goal, plans, chooses tools, observes results, and decides whether to continue. Each step can fail independently. A correct final message can conceal a forbidden read, an unnecessary tool call, or a duplicate side effect, so save and inspect the full trace.
Test tools as security boundaries
Give the agent only the tools and resource scope required for the task. Try other users’ identifiers, malformed arguments, stale credentials, and instructions embedded in tool results. Verify server-side authorization; a prompt telling the model not to access data is not a security control.
Exercise planning and stopping behavior
Use ambiguous goals, impossible goals, conflicting constraints, cyclic results, and tools that return no progress. The agent should ask for missing information, stop within sensible limits, and explain what remains incomplete rather than inventing success.
- Confirm before external communication, deletion, payment, or other consequential actions.
- Reject or safely quote instructions found in untrusted documents and webpages.
- Detect repeated calls that do not change state.
- Preserve an audit record a human can understand.
Design failure recovery around uncertain outcomes
A timeout does not prove a tool failed. Query state before retrying, use idempotency keys for writes, and tell the user when the outcome is uncertain. Test cancellation between steps and verify temporary resources, locks, or drafts are cleaned up safely.
What should a QA engineer do next?
Choose one two-tool workflow and draw every state transition. Add cases for denied access, malicious tool output, timeout after commit, repeated no-progress calls, and user cancellation. Assert the trace, final state, user message, and audit evidence.