There is a standard reading list circulating for people getting into agent work. Thirty core concepts, sometimes forty, arranged into tidy groups: building blocks, configuration, memory, orchestration, safety, observability.
The lists are accurate. They are also mostly a tax, because a reader who works through all thirty spends most of that effort learning familiar things under unfamiliar names, and arrives with no better sense of what is actually different about building these systems.
Sorting one of these lists by a single question fixes that. Does this concept have no prior analogue, and does knowing it change what I build?
Six survive.
What the other twenty-four are
Two categories, and it is worth being blunt about both.
Ordinary engineering, renamed. Agent state is state. Agent loops are loops. Permissions are permissions, sandboxing is sandboxing, and pre-commit gates were pre-commit gates. Logging, tracing and metrics are the same three things they have always been, and the guidance attached to them in these lists is the guidance you would give about any distributed system. Structural linting is linting.
None of this is wrong and none of it is new. If you have shipped a service, you have all of it already, and reading a section explaining that agents need logs is time you do not get back.
Product categories. Orchestration tools, workflow frameworks, managed hosting, web search integrations, chart generation. These are things you can buy, and buying them is a procurement decision, not a concept. They belong in an evaluation spreadsheet rather than a syllabus, and the reason they read as concepts is that vendors write most of the material.
That leaves the residue, and the residue is small and genuinely strange.
The six that have no analogue
1. Context rot
More context makes performance worse before you hit any limit. Not slower — worse. A model given all 46 tools of a benchmark failed it and passed when given 19, with room to spare either way.
There is no equivalent anywhere in software. More RAM does not make a program dumber. This one property is why context has to be curated rather than filled, and it invalidates the intuition everyone brings from working with databases, where the answer to “will more data hurt” is no.
Everything downstream of it — retrieval instead of stuffing, compaction, deciding what not to load — exists because of this one fact. It is the load-bearing idea in the whole area.
2. Prompt caching
A cache whose behaviour depends on the order of your input. A stable prefix followed by variable content is cheap; the same content with the variable part first is not, because the cache matches on prefixes.
The reason this is worth learning rather than looking up is that it constrains structure. You lay out prompts with the invariant material first — system instructions, tool definitions, the document under discussion — and the varying part last, and that layout decision is made at design time. Get it backwards and you pay full price on every call, with nothing in the output to indicate why.
3. Prompt injection
The one genuinely new security class, and the one with no clean fix.
Instructions and data arrive through the same channel. A document your agent reads can contain text that the model treats as a directive, and there is no parameterisation that separates them the way prepared statements separate SQL from values. The nearest analogue teaches the wrong lesson: SQL injection has a complete solution, and this does not.
What you get instead is defence in depth — narrow permissions so a successful injection can do little, human gates on consequential actions, and treating all retrieved content as hostile. Which means the mitigation lives in the architecture, and it has to be there from the start.
4. Subagents as context isolation
Delegation is old. Delegating to keep material out of a caller’s context is new, and it is a different reason with different economics.
A subagent earns its cost when it consumes a great deal and returns a little: a wide search, a long exploratory read, anything where the useful output is a fraction of the input. A subagent that reads one file and reports what it says has moved a cheap operation into an expensive one. The heuristic — delegate for isolation, not for tidiness — inverts the usual instinct that smaller components are better.
5. Hooks
Deterministic code that runs at fixed points in a non-deterministic loop, and the only mechanism in the stack that produces a guarantee.
Everything else here is probabilistic. A hook that blocks a write outside an allowed directory blocks it every time, regardless of what the model concluded. That is the difference between “the agent has been instructed not to” and “the agent cannot”, and every property you actually need to hold belongs on the second side of that line.
Worth learning early, because the instinct is to encode rules in the prompt, and a rule in a prompt is a preference.
6. Persistent memory
A write that outlives the session, with no transaction, no review, and no schema.
The new failure mode is specific: the agent records something wrong, and every later run reads it as established fact. You have manufactured a bad row in a database nobody audits, and unlike a bad cache entry it will not expire. This is why read and write access to memory deserve to be separated, and why write access is the one permission whose mistakes outlive the run that made them.
Why the trimmed list is more useful
Six concepts is a morning. Thirty is a week, and the week produces a worse mental model, for a reason worth naming.
A long list flattens importance. Context rot, which invalidates an intuition you have relied on for your entire career, sits at number nine between two items about configuration files. Prompt injection, which has no complete fix and must shape your architecture, appears at twenty-three next to linting. Presented as peers, they read as peers, and the two that should change your design get the same weight as the one telling you to use logs.
The six above share a property the other twenty-four do not: each one changes a decision on a diagram. Context rot changes what you load. Caching changes prompt layout. Injection changes where the permission boundaries go. Isolation changes when you delegate. Hooks change what you enforce in code rather than in text. Memory changes who may write.
Read the rest when you need them, the way you would read any reference. Learn these six before you draw the first box.