Agent platform and runtime
How to use
Agno.
Building Python agents, specialist teams, and deterministic workflows, then serving and managing them through AgentOS with sessions, memory, knowledge, tracing, evaluation, RBAC, and approvals.
Agno is a Agent platform formerly known as Phidata for Python agents, teams, workflows, memory, knowledge, evaluation, tracing, and AgentOS operations. Building Python agents, specialist teams, and deterministic workflows, then serving and managing them through AgentOS with sessions, memory, knowledge, tracing, evaluation, RBAC, and approvals. This guide covers the whole path in one place: official access, a first session that produces something reviewable, the checks that make output trustworthy, and the permissions worth limiting before you connect real work.
AI should make the work easier to inspect. If the workflow removes the source, the owner, or the review step, redesign the workflow.
Access & setup
Find, install, and sign in to Agno
Get into the official Agno experience with the right account and a setup you understand.
- 01
Start at https://agno.com/ and confirm the domain before entering account or payment information.
- 02
Availability: Agno is installed as a Python SDK and served through AgentOS, with a web control plane and Studio connected to the user's own runtime and database.
- 03
A supported Python environment, model and integration credentials, an application database, authenticated AgentOS deployment, tenant and user identity design, approved tools and knowledge, evals, and observability and incident ownership.
- 04
Sign in with the account you intend to keep using, then review plan, data, notification, and permission settings.
- 05
Run one low-risk test task before connecting sensitive files, repositories, or workspace data.
- Use official download pages.
- Review permissions during setup.
- Keep installers and applications updated.
First session
Your first useful Agno session
Learn the interaction loop using a small task with a clear outcome.
- 01
Define the task, users and tenants, model, tools, knowledge, state, memory, output schema, autonomy, approvals, quality, safety, retention, cost, and deployment requirements.
- 02
Start with one typed agent and only add a team when specialization is measured or a workflow when deterministic control, branching, pause, or recovery is required.
- 03
Use a private database and authenticated AgentOS instance, scope user and session IDs, register narrow tools, and test guardrails, human approval, persistence, and structured output.
- 04
Evaluate representative and adversarial runs, inspect traces and stored state, verify tenant isolation and tool authorization, then canary the version and retain rollback and deletion procedures.
- State the outcome before the background.
- Provide the real source material.
- Review the result before expanding the task.
Quality control
Check the quality of Agno output
Establish that an autonomous run did the right thing, not merely that it finished.
- 01
Define what the run should achieve and what it must never touch before granting it a single tool.
- 02
Read the full execution trace: which tools were called, with what arguments, and in what order.
- 03
Verify the side effects directly in the target system rather than trusting the agent's own report of success.
- 04
Confirm failures surfaced as failures — a silent retry loop or a swallowed error is more dangerous than a crash.
- 05
Re-run the same task and compare: an agent that behaves differently across identical runs is not yet production-ready.
- Verify side effects in the system of record, not in the agent's summary.
- Require human approval for any irreversible or outward-facing action.
- Log every tool call so a run can be reconstructed afterwards.
Privacy & permissions
Use Agno safely
Bound what an autonomous system can reach before you let it run unattended.
- 01
Enumerate every tool, credential, and system the agent can reach, and remove the ones it does not need.
- 02
Require explicit human approval for irreversible actions: sending, publishing, paying, deleting, or deploying.
- 03
Run against non-production data until behaviour is predictable across repeated runs.
- 04
Set hard limits on spend, iterations, and runtime so a failure loop cannot run unbounded.
- 05
Treat anything the agent reads from the web or a document as data, never as instructions it may follow.
- Phidata is the former name; current code and documentation use Agno and AgentOS, and older tutorials may reference removed or deprecated APIs. Persistent sessions, memory, knowledge, traces, callable caches, teams, and tools create privacy and cross-user risks. Bind state to authenticated identities, authorize tools independently, use narrow roles and approvals, pin versions, redact logs, cap loops and cost, and test migrations and deletion.
- Follow your organisation's approved-use policy.
- Never treat fluent output as authorization to act.
Core workflows
Step-by-step ways to use Agno for the work it does best.
Each workflow below has its own outcome, steps and review checkpoints.
Bind AgentOS sessions, memory, knowledge, and tools to authenticated users and tenants before exposing an agent API.
↓ 02 WorkflowDesign an Agno team only when evidence requires oneStart with a single agent, then add specialist members or deterministic workflow steps only for measured capability or control gaps.
↓Workflow 01
Serve a tenant-safe Agno product agent
Bind AgentOS sessions, memory, knowledge, and tools to authenticated users and tenants before exposing an agent API.
Outcome: Provide persistent assistance without cross-user memory leakage, unauthorized tools, or uncontrolled stored context.
- 01
Define surfaces, users, tenants, agent role, data classes, model, knowledge, tools, session and memory policy, retention, approvals, SLO, budget, and audit ownership.
- 02
Deploy AgentOS privately with authenticated routes, a production database, least-privilege service accounts, encrypted transport and storage, scoped secrets, and separate environments.
- 03
Derive user and session IDs from verified identity, apply tenant filters to knowledge and state, register narrow tools with current authorization, and require approval for consequential effects.
- 04
Test forged IDs, cross-tenant retrieval, memory poisoning, prompt injection, stale permissions, concurrent sessions, tool denial, model failure, database outage, deletion, and key rotation.
- 05
Review traces and evals with redaction, monitor storage growth and cost, canary versions, audit roles and tools, and support user export, correction, memory reset, and deletion.
What good use looks like
- Derive session identity server-side.
- Filter all knowledge by tenant.
- Support memory reset and deletion.
Workflow 02
Design an Agno team only when evidence requires one
Start with a single agent, then add specialist members or deterministic workflow steps only for measured capability or control gaps.
Outcome: Gain useful specialization without multiplying coordination errors, permissions, latency, token cost, and debugging complexity.
- 01
Benchmark one agent on a frozen task set and identify specific failures in expertise, context, parallelism, routing, or deterministic control that justify a team or workflow.
- 02
Give each member one role, minimal knowledge and tools, explicit handoff schema, separate budgets and permissions, and choose coordinate, route, broadcast, or workflow control deliberately.
- 03
Keep consequential effects in deterministic approval-gated steps, cap delegation depth and calls, isolate member context, validate handoffs, and prevent members from expanding their own capabilities.
- 04
Test wrong routing, contradictory members, delegation loops, prompt injection propagation, permission escalation, partial failure, stale shared state, cancellation, latency, and total cost.
- 05
Compare quality and trajectory against the single-agent baseline, inspect member traces, remove members without measurable value, canary changes, and retain a simpler fallback.
What good use looks like
- Prove the single agent is insufficient.
- Give each member minimal permissions.
- Measure coordination cost and failures.
Official references
Check the current product documentation.
Features, plan limits, availability, and data controls change. These official pages are the starting points used for this guide.