Agents

Memory gave the application persistent state. Function calling gave it access to external tools. But both are still ingredients. The next question is how to combine them into a loop that can pursue a goal over multiple steps.

What if one tool call is not enough?

Consider: Find the cheapest flight to Tokyo next Friday, check whether I am free on my calendar, book it if it is under $900, then email me the itinerary.

Now the model must break the problem into steps, remember previous results, decide which tool to call next, recover if a step fails, ask for approval before booking, and know when to stop. That is the motivation for agents.

Function calling is like hiring a specialist. An agent is like hiring a project manager. The manager does not personally fly the plane, query the airline database, or send mail from scratch. The manager repeatedly asks: what should happen next?

That recursive decision-making is the essence of an agent. It is not usually a new kind of neural network. Most LLM agents today are:

The novelty comes from the software architecture around the model. The model performs inference repeatedly while the surrounding system tracks state, executes tools, and decides whether the objective is complete.

The canonical loop is:

A compact algorithm is:

while not finished:
    thought = think(goal, memory)
    action = choose_action(thought, available_tools)
    observation = execute(action)
    memory = update(memory, action, observation)
    finished = check_stopping_condition(goal, memory)

This is fundamentally different from one-shot prompting. A one-shot prompt produces one answer. An agent repeatedly uses the answer to decide what to do next.

State, Action, Observation

We can describe an agent loop with a simple state transition:

$S_t$ is the current state: goal, memory, tools, observations, constraints, and current plan. $\pi$ is a policy that chooses an action $A_t$. The environment returns an observation $O_t$, and the controller updates state.

Reinforcement learning studies how to learn policies. Most LLM agents today do not learn during deployment. They approximate a policy by running inference repeatedly inside a software loop.

Some agents are mostly reactive: observe, choose the next useful action, observe again. This works when the task is short or the next action is obvious.

More complex tasks benefit from planning:

For a Japan holiday planner, a first plan might be: check dates, search flights, check weather, find hotel options, compare budget, ask for booking approval, send itinerary. The plan is useful, but it must remain revisable. If flight search fails or prices are too high, the agent should change strategy rather than blindly continue.

Agents need memory because later actions depend on earlier observations. Without memory, an agent may repeat tool calls, forget constraints, or contradict itself.

Short-term memory often lives in the context window: conversation history, tool outputs, plans, and intermediate state. Long-term memory usually lives outside the model in vector databases, SQL databases, files, knowledge graphs, or user profile stores. Agents often combine memory with RAG.

Agents generalize function calling by coordinating multiple calls over time.

Branching is especially important. If the weather is good, suggest an outdoor activity. If it is rainy, suggest a museum. If the flight is over budget, search nearby dates. Agent behavior depends on observations.

Termination is a critical design problem. An agent should stop when the goal is achieved, when it needs human approval, when maximum iterations are reached, when a timeout occurs, or when a cost limit is hit.

Agents consume tokens, latency, API calls, and money. A loop of ten model calls and five API calls may be far more expensive than one well-structured prompt. Autonomy is useful only when the loop creates enough value to justify the cost.

For actions with real consequences, stopping should include human confirmation: purchases, bookings, emails, deletes, payments, and permission changes should not be hidden inside an autonomous loop.

Small Agent Loop

def run_agent(goal, tools, max_steps=8):
    memory = []

    for step in range(max_steps):
        action = choose_next_action(goal=goal, memory=memory, tools=tools)

        if action["type"] == "final":
            return action["message"]

        if action["type"] == "needs_approval":
            return ask_user_for_confirmation(action["message"])

        observation = execute_tool(action["tool"], action["arguments"])
        memory.append({
            "action": action,
            "observation": observation,
        })

    return "Stopped because the agent reached the iteration limit."

In a real LLM agent, choose_next_action is often a model call using the goal, current memory, tool descriptions, policies, and stopping rules.

Travel Planner Sketch

goal = "Plan a Japan trip under a $900 flight budget."

tools = {
    "search_flights": search_flights,
    "calendar": get_calendar_events,
    "weather": get_weather,
    "hotels": search_hotels,
    "email": draft_email,
}

state = {
    "goal": goal,
    "budget": 900,
    "memory": [],
    "needs_confirmation": ["book_flight", "send_email"],
}

final_answer = run_agent(goal=goal, tools=tools, max_steps=10)

Agents should be evaluated as systems, not as single responses.

A beautiful final answer is not enough if the agent called the wrong tools, spent too much money, ignored a failure, or took an unsafe action along the way.

Agent failures include infinite loops, repeated tool use, hallucinated plans, context overflow, tool misuse, wrong stopping, planning collapse, and failure to recover after an observation contradicts the plan.

Security matters because agents can chain actions. Use permission boundaries, tool allowlists, rate limits, secret isolation, prompt-injection defenses, audit logs, and user confirmation before purchases, bookings, deletes, emails, or payments.

Tool outputs should be treated as data, not instructions. A retrieved page or API response should not be allowed to override system rules or grant itself new permissions.

A useful mental model is: prompting shapes one response, RAG supplies evidence, function calling executes one step, and agents coordinate multiple steps over time.