What is an agent? Loops, autonomy and workflows vs agents

The loop

A language model by itself is a function from text to text. An agent is what you get when you put that function inside a loop and let its outputs change the world:

state  = initial task + environment
repeat:
    observation = render(state)                 # what the model sees (its context)
    action      = model(observation)             # text, or a structured tool call
    if action is a final answer: stop
    state       = environment.step(action)       # run the tool, update the world

Three things hide in those five lines. The observation is the model's entire world at that step: system prompt, tool definitions, history, retrieved documents — this is the context window, and curating it is the subject of 10.4 Memory and context engineering. The action is either plain text or a tool call, a structured request that your code executes (10.2 Tool use and function calling). The environment is whatever the tools touch: files, a browser, a database, an API, another agent. The crucial asymmetry: the model proposes, the harness disposes. The model never runs anything; the code around it does. That code — the loop, the tools, the budgets, the permission checks — is the harness, and most of agent engineering is harness engineering (10.11 Building production agents).

Intuition. In reinforcement-learning language (4.11 Reinforcement learning essentials) an agent is a policy $\pi(a_t \mid h_t)$ that picks an action given the history $h_t$. For an LLM agent the policy is a frozen (or lightly RL-tuned, 8.3 Alignment: RLHF, PPO, DPO, GRPO and Constitutional AI) model, and all "learning" during a task happens in the history, i.e. in context. That is why context quality dominates behavior: you cannot change the weights at run time, only what the policy conditions on.

Workflows versus agents

Anthropic's Building effective agents (December 2024) drew the distinction most teams now use:

• Workflows are systems where LLMs and tools are orchestrated through predefined code paths. You wrote the control flow; the model fills in steps. A chain "summarize → classify → draft" is a workflow even if every step is an LLM call.
• Agents are systems where the LLM dynamically directs its own process and tool usage, deciding how to accomplish the task and when it is done.

Both are "agentic systems", and the practical advice is to start with the simplest thing that works. A useful way to see the space is as an autonomy spectrum:

Moving right buys flexibility and pays with latency, tokens and variance. The right level is the leftmost one that solves the problem.

Anatomy of an agent

• Model. The reasoning engine; today usually a frontier model with native tool use and, often, a reasoning mode (8.6 Reasoning models and test-time compute).
• Tools. Functions with schemas the model can call: search, code execution, file edits, browsers, other agents (10.2 Tool use and function calling).
• Memory / context. Working memory is the context window; long-term memory is whatever you store outside it and retrieve later (10.4 Memory and context engineering).
• Planning. Explicit or implicit decomposition of the task (10.3 Reasoning and planning for agents).
• Environment feedback. The thing that makes agents work at all: test results, compiler errors, search hits, API responses give the model ground truth it cannot hallucinate away. Tasks with cheap, trustworthy feedback (code) are where agents succeeded first (10.8 Coding agents and computer use).
• Harness and controls. Budgets, permission checks, human approvals, logging, retries (10.10 Agent safety and security, 10.11 Building production agents).

A short history

2022–2023: the ideas. ReAct (October 2022) showed that interleaving reasoning traces with actions beat either alone. Toolformer taught a model to call APIs by self-supervision. Spring 2023 brought the AutoGPT/BabyAGI wave: GPT-4 in a loop with a to-do list and web access. They were thrilling and mostly useless: no reliable structured tool calling (actions were parsed from free text), tiny context windows, no verification, and costs that spiraled as the loop wandered. The same year Generative Agents simulated a village of 25 characters with memory and reflection, Voyager learned Minecraft skills as a growing library of code, and HuggingGPT used an LLM to orchestrate other models.

Mid-2023–2024: the plumbing. Function-calling APIs made tool use structured and reliable. SWE-bench (October 2023) gave the field a hard, verifiable target; a year later agents were solving a large fraction of it. Computer use arrived as a public beta (Anthropic, October 2024). τ-bench showed how unreliable agents were across repeated trials. Building effective agents (December 2024) codified patterns and the "start simple" discipline.

2025: agents in production. The Model Context Protocol (announced November 2024) became the standard way to plug tools into models and was adopted across the industry during 2025 (10.7 MCP and interoperability (plus Agent Skills and A2A)). Coding agents (Claude Code, Codex-style tools, agentic IDEs) moved from autocomplete to multi-step work (10.8 Coding agents and computer use). OpenAI's Agents SDK, Google's ADK and the A2A protocol appeared. Reasoning models became the default planners. Security researchers named the "lethal trifecta" (10.10 Agent safety and security).

2025–2026: long-running and managed agents. The frontier moved to agents that work for hours or days: harness design with progress files and clean-context sessions, agent memory as a first-class component, sandboxed execution separated from the model's reasoning loop, and serious agent evaluation. Each is a lesson in this phase.

When you should not build an agent

• The task has a known, fixed sequence of steps → write a workflow; it is cheaper, faster and testable.
• Errors are costly and hard to verify (money moves, data is deleted, messages go out) and you cannot insert a human check → do not automate the decision, automate the preparation.
• Latency or budget is tight: a single chat turn costs one model call; an agent may cost dozens.
• You have no evaluation set. An agent you cannot measure will regress silently (10.9 Evaluating agents).

Cost and reliability, up front

Anthropic's multi-agent research write-up reported that in their systems a single-agent interaction used roughly 4× the tokens of a chat turn and multi-agent systems roughly 15×. Reliability compounds the other way: if each of $n$ steps succeeds with probability $p$, the task succeeds with probability about $p^n$ — at $p = 0.95$ and $n = 20$ that is $0.95^{20} \approx 0.36$ (10.9 Evaluating agents). Every design decision in this phase is, at bottom, an attempt to raise $p$ (better tools, context, verification) or reduce $n$ (better decomposition, more capable steps) while keeping the token bill and the blast radius bounded.

Where this shows up later

• The loop becomes real code with tool schemas in 10.2 Tool use and function calling; the "reason" step is expanded in 10.3 Reasoning and planning for agents; the observation is engineered in 10.4 Memory and context engineering.
• The autonomy spectrum becomes concrete patterns in 10.5 Agentic workflow patterns and multi-agent topologies in 10.6 Multi-agent systems.
• The reliability math returns with benchmarks in 10.9 Evaluating agents; the "costly, irreversible actions" caveat becomes the security model of 10.10 Agent safety and security.