An agent is four steps in a circle and not one of them is checking. An agent is a loop: the model picks a tool, the tool runs, the result goes back in, and the whole transcript is read again from the top with that result now part of it.
Dermot Casey keeps the books for a shellfish co-op in Galway and had 214 scanned delivery dockets that needed to become filenames, each one a supplier, a date and a weight. He built the loop in an afternoon. It worked on the first twenty, and then it kept working, in the sense that it never stopped.
The docket that was never read
Number 61 had been photographed at an angle on a wet quay. The extraction step returned half a line, the model produced a weight that sat comfortably between the two dockets either side of it, the rename ran, and the loop went round. The result appended to the transcript was the word ok.
This is the failure to expect first, and it is not a wrong answer, it is a right-looking report. A tool that returns success has told you the call worked, not that the answer is right. The rename succeeded. Renaming is all the rename tool knows how to have an opinion about, and the loop has no other source of opinion in it.
The fix is on the tool rather than on the model. Give a tool a way to say it does not know, or the loop will invent the value, because the request had no other exit. Dermot's extraction step now returns the three fields or the single word unreadable, and the run ends with a list of the dockets that came back unreadable, which on the first proper run was nine of the 214. Nine files to open by hand on a Tuesday is a result. One silently plausible weight inside 214 correct ones is not.
The forty minutes nobody asked for
The other half of that first afternoon went on a line at the end of the instructions: then tidy up the folder. The loop renamed everything, listed the folder again, noticed that three of the names it had just written were less consistent than the rest, renamed those, listed the folder again, and carried on being slightly dissatisfied for forty minutes.
Nothing had failed. The stopping rule is the part nobody writes, and the part that costs the afternoon: tidy has no test that can come back true, so the loop can always find one more thing, and a loop with no reachable finish does not error, it bills. A finish has to be countable from inside the loop. Dermot's is now 214 dockets in, 214 filenames out, and the unreadable ones named, which is a condition the agent can evaluate rather than a standard it can aspire to.
Every tool is a permission
He gave the loop a shell command in the first version, because writing a rename function was ten minutes of work and passing through a shell was one. Every tool granted is a permission granted, and the model decides when to use it, which is the whole difference between a tool list and a menu. A shell is not one permission. It is every permission the account has, handed over in advance, to be spent at a moment nobody will be present for.
The narrow version costs the ten minutes and is worth them: a rename function that takes a source and a destination inside one named folder can do exactly one wrong thing, and the wrong thing it can do is recoverable. That is the argument running through the limits that make autonomy safe to grant, and the reason the limits are set before the first run rather than after the first surprise.
The transcript is the memory, and it fills
Nothing persists between steps except the text of the run so far. The transcript is the memory, and the loop fills it faster than a conversation does, because every step writes into it twice, once as the tool call and once as whatever the tool returned. A folder listing of 214 filenames is a wall of text that the loop now re-reads on every subsequent step.
Which is why the run got slower toward the end and why step 180 knew less about step 3 than step 4 did. Deciding what is carried, what is summarised and what is written to a file and read back on demand is what an agent remembers between steps and between runs, and it is a design decision rather than a setting, made once the transcript stops fitting.
The order
The far bank is not further along, it is a different reading arrangement
On one side a person reads every output. On the other side nobody is at the desk, and every plank exists because of something that cannot be caught by looking.
- 01The loopFour steps, and what each one can and cannot know
- 02The toolsEach one a permission, spent when the model decides
- 03The stopping ruleThe plank nobody lays, and the one people fall through
- 04The transcriptThe only memory there is, and it fills up
- 05Somebody else's loopOrchestration, and only once one loop is boring
Planks laid out of order still make a bridge you can walk on, which is the difficulty. The gap only shows up on the crossing where nobody is watching.
The stall is the run that worked
Dermot's loop worked on the first twenty dockets, and the first twenty are what everybody has. A run that worked is evidence about that run, and it gets read as evidence about the loop, which is a different claim and one that nothing in the output distinguishes. This is where people stop, and it does not feel like stopping, because the loop is now doing an hour of work a day and the hour is real.
The habit that gets past it is small and nobody enjoys it: read the transcript in the middle rather than the answer at the end. Every failure on this page announced itself in the middle, in a step that returned ok, and not one of them announced itself in the summary. Docket 61 surfaced six weeks later when a supplier queried an invoice, which is the ordinary way these are found.
What order this goes in, and the crossing it is
Start at the line between a chat and an agent, which is worth twenty minutes because most of what is sold as an agent is a chat with a longer preamble. Then letting a model do things instead of describe them, then the stopping rule, then the limits, and only after all four arranging several steps, or several agents.
Taken in the exciting order, orchestration comes second and the rest never comes at all. Several agents arranged around a problem is a satisfying thing to draw and it multiplies whatever the single loop was already doing, including the reporting of success by tools that only checked themselves. A person who has not yet watched one loop produce a plausible weight will build five of them and read the summary at the top.
Agents that read and write a codebase are where most readers meet all of this for real, and they are the gentlest place to meet it, because a repository has an undo and a shellfish co-op's folder of scans does not.
What to open in 2026
The Model Context Protocol is how a tool is described to a model as of 2026, and it replaced writing a bespoke function-calling wrapper for each assistant. It is an open specification with open source reference servers, so the free path is the whole path. What it buys is not capability, it is that the list of what an agent may touch is a file you can read in one screen.
Claude Code is where most people will watch a real loop for the first time, as of 2026, and it replaced the autocomplete that guessed the rest of the line you were typing. There is no free path worth the name; it runs on a paid plan or on API credits. The thing to look at is not the answer at the end but the transcript in the middle, because that is the only place where a tool reporting success on a thing it did not verify is visible at all.
Git is the review surface. As of 2026 it replaces reading every file an agent touched in order to find out what it did, and it is free and open source. An agent editing inside a repository leaves a diff that can be read in a minute; the same agent editing a folder of scans leaves 214 files and a feeling.
All of which leaves the question that the fix above only postponed. Dermot can count 214 in and 214 out because dockets are countable. Most work worth handing to a loop does not come with a number at both ends, and then the finish has to be defined rather than counted, which is the same problem as tests for a system that does not answer the same way twice, and it is the reason deciding whether to trust what came back belongs before any of this rather than after it.