Agents
Agentic structure: how an answer becomes a controlled action.
From an answer to a sequence
An agent is a model working inside a loop
A chatbot gives you an answer and waits for the next question. An agent is a model placed inside a system that can pursue a goal through several actions. The system shows the model the current state, lets it choose a permitted next step, runs that step through a tool, and returns the result. An evaluator then decides whether the work should continue, be revised, ask for approval or stop safely.
That repeated cycle is the agentic loop: observe, choose, act, evaluate. The model does not gain initiative in a human sense. It is being called again with new evidence until the goal is reached or a stopping condition wins. Once you see the loop, the term “agentic” becomes less mysterious and much easier to design responsibly.
An agent is a controlled action loop
The model chooses within a system that defines observation, tools, evaluation and stopping.
- Observe Receive task state, evidence and tool results.
- Choose Propose the next bounded action.
- Authorize Check permissions, consequence and escalation.
- Act Call a tool or produce a reviewable artifact.
- Evaluate Compare the result with a fixed success contract.
- Stop, retry or escalate Do not let motion become an infinite loop.
Agency comes from the loop and authority model, not from the language model alone.
Three contributions, one result
The model proposes; the system decides what can happen
Three parts contribute different things. The model interprets the situation and proposes a next action. The harness, the software around the model, provides tools, relevant state, permissions, checks and the control flow that runs the next turn. The operator defines the goal, the policy and the boundary where human judgement is required.
The distinction matters because a persuasive model response is not permission to act. The harness should enforce authority in code. Reading a record, calculating a value or drafting a message may be reversible enough to run automatically. Sending the message, deleting data or moving money may require approval. The model can recommend crossing that line. It should not be able to move the line itself.
The model proposes; the system governs
Separate generative capability from the controls that surround consequential action.
Inside the model call
- Interpret context Builds a working representation from supplied evidence.
- Generate a candidate Suggests an answer, plan or tool call.
- Express uncertainty imperfectly Confidence language is not calibrated proof.
put control outside
Outside the model call
- Permissions Decide which tools and resources are available.
- State and memory Control what persists and what expires.
- Checks and human authority Accept, reject, retry or escalate the candidate.
Critical controls should not depend on the same generation they are meant to constrain.
A worked example
Follow one refund request through the loop
Imagine an agent helping with a customer refund. It observes the request and chooses a first action: retrieve the order. The tool returns the order date, product and payment status. The model compares those facts with the refund policy, then drafts a recommendation and a customer reply.
Now the evaluator checks the recommendation against explicit rules. Is the order real? Is the request inside the refund window? Does the proposed amount match the payment? If the evidence agrees, the loop can prepare the case for approval. A person with financial authority reviews it before any money moves. If the order cannot be found, the policy conflicts with the request, or a tool fails, the safe result is not another confident guess. It is a stopped case that says what is missing and who needs to decide.
The example is modest on purpose. Useful agency is not measured by how long the system can run alone. It is measured by whether each step has the evidence, authority and recovery path appropriate to its consequence.
Feedback needs an independent check
A loop without an evaluator can repeat the same mistake
Feedback alone is not enough. If the model proposes an action and then grades that action using the same assumptions, the loop can turn one error into a sequence. Small drift compounds when later steps treat an earlier mistake as established fact.
An evaluator can be a deterministic rule, a test, a second model with a narrower brief, or a human review. The choice should follow the risk. A format check may be enough for a draft. A financial decision needs stronger evidence and accountable approval. Evaluators also fail, especially when they share the model's missing context, so the loop needs limits: maximum attempts, time or cost ceilings, and a safe state to return when confidence is not earned.
Capability still matters
A stronger model helps, but structure governs the action
Model capability remains important. A better model may interpret a goal more accurately, choose tools more reliably or recover from an unexpected result. Those abilities can improve unevenly between models and tasks, which is why a system should be evaluated on the work it will actually perform.
Structure determines how much of that capability can be used safely. It controls what runs, what evidence returns, what requires approval and when the work stops. Delegating bounded pieces of work can also protect the main working context, but more agents create more coordination and review obligations. Neither a better model nor a more elaborate loop removes the operator's responsibility for the outcome.
A practical design test
Design the stop before you design the autonomy
Before giving an agent another action, ask four questions. What evidence will it observe? What action is it actually allowed to take? Who or what evaluates the result? What safe state receives the work when the answer is uncertain? If those answers are vague, adding more autonomy increases the surface of the uncertainty.
Agentic systems are one application of harness engineering: deliberate context, tools, control flow, evaluation and permissions around a model. The professional goal is not to make the model look independent. It is to make useful action inspectable and reversible, while keeping consequential judgement with the people accountable for it. That is also the human return I care about: attention can move away from supervising every harmless step without pretending responsibility has moved with it.