The loop, written out
An agent is not a model. It is a loop around a model, and the loop is where every property of the system comes from.
- Build the context: the system prompt, the task, the history so far.
- Call the model and read its output.
- If it asked for a tool, run that tool.
- Append the call and its result to the history.
- Go back to step one, until the model answers instead of calling, or a limit is hit.
- : the action the model chose.
- : what the tool returned.
The model is stateless. Every iteration re-reads the whole history, which is what makes the loop's memory management the central design problem.
The context grows, and the cost with it
Each step re-sends everything before it, so a twenty-step task costs on the order of the square of a one-step task, not twenty times.
Tool results are the bulk of it. A file read or a search result can be thousands of tokens, and it is re-sent at every subsequent step.
Truncating tool output at the boundary, before it enters the history, is worth more than any other single optimisation in an agent.
The limits are load-bearing
Cap the loop three ways: steps, a token budget and a wall clock limit.
A loop with no step limit does not terminate on the hard cases, it repeats. Two tools that undo each other produce a cycle that looks like progress.
Detecting a repeated action and injecting a message saying so is cheap and breaks most loops, which a step limit only ends after paying for every iteration.
Budgets belong to the loop rather than to the model, because the model has no way to know how much it has already spent.
Where the errors compound
If each step succeeds independently with probability , a ten-step task at succeeds 60 percent of the time.
That is the structural argument for fewer, larger steps, and for tools that do more per call rather than being primitive.
It is also the argument for making the loop recoverable at every step.
An error returned to the model as an observation is one the model can route around, and an exception that kills the loop is not.
What the loop owns and the model does not
Validation of arguments, because a malformed call should be corrected rather than executed.
Permission, because whether a tool may run is a policy question and the model is not the right place to enforce policy.
Persistence, so that a loop interrupted at step twelve resumes rather than restarts.
The full history is stored by the loop. What is sent to the model is a view of it, and choosing that view, by summarising, dropping or reordering, is most of the engineering.