How an agent plans, picks its tools, acts, reads what came back, and knows when to stop — drafted station by station, with the guards that make it safe to run unattended.
One instruction in, one outcome out. Everything between is this loop.
One instruction arrives in natural language. Everything below exists to honour it — including knowing when honouring it means stopping.
The model turns the goal into reasoning and an ordered subtask list. This is the run's blueprint; everything after it is execution.
Each subtask is matched against tool schemas — name, description, inputs, outputs. Best match wins; the call is validated against the schema before it goes anywhere.
A typed call goes out — to an API, a system, or another agent — and a raw result comes back. Structured in, structured out.
The raw response becomes a structured observation. Two questions, every time: did I get what I needed — and is it enough to proceed?
The observation lands in two places: the running context of this conversation, and the long-term stores that outlive the run.
Done means the success criteria from station 01 are met. If not: update the context, revise the plan, return to station 03.
The observations become one answer — checked against each other first, then drafted. The final generation itself is a normal model inference pass.
Stream the text, return the structure, or take the action — whichever the instruction asked for. Gated actions get logged like everything else.
Five properties that decide whether the loop survives contact with production.
Retries, fallbacks, and the option to ask a person. An agent that cannot say "I'm stuck" is not reliable — it is quiet.
Every model call and every tool round trip adds up. Parallelise independent calls; the loop's speed is architecture, not model choice.
Grows with iterations × context size × tool calls. Ceilings are configuration, not hope.
Log plans, tool calls, results, errors and latency. A run you cannot replay is a run you cannot audit — or debug.
A person holds final authority over anything high-impact or irreversible. At ImageFirm this is not a setting — it is the rule the settings serve.
What the popular sheet leaves out — and what fails first without it.
Every tool result is untrusted input. Instructions found inside data stay data — quarantine them; never promote them to commands.
Scoped credentials, allowlisted actions, sandboxed execution. The agent gets the keys the task needs — none it might enjoy.
A loop that has not passed offline evals runs with a person watching — or it does not run.
This sheet is the method in the open. If you want it applied to your own agents — built, guarded and gated — start with an enquiry and tell us what you are trying to run.
Start an enquiry