The loop, step by step

Most tasks take more than one tool. The model asks, the harness acts, the result comes back, and the model decides what to do next, around and around until the job is done. Researchers formalized this pattern of reasoning, acting with a tool, observing the result and repeating in 2022, in work called ReAct.¹ When a harness runs this loop and the model chooses its own next steps, people call the combination an agent.²

Here is one trip around the loop, numbered as in Figure 8.1. The example was written for this page: the file and the numbers are made up, while the shapes of the request and the result follow the providers’ documentation.³⁴

Try it: step through the loop, and allow or deny the tool when the harness asks.

1. 1. You ask. An accountant types: “Find our Q3 budget file and tell me where we overspent.”
2. 2. The harness builds the prompt. It puts its instructions, the list of tools the model may ask for (here, search_files and read_file) and the message together, as one text for the model to read.
3. 3. The model asks for a tool. It can’t open files, so it writes a request: the tool’s name, search_files, and the input, “Q3 budget.” Then it stops and waits. The request is text; it is all the model produces.
4. 4. The permission gate. The harness checks its rules. Some tools are allowed outright; for others it asks the person first. Here the accountant chooses Allow.
5. 5. The harness runs the tool. The harness, not the model, searches the shared drive and finds Q3-budget.xlsx.
6. 6. The result goes back in as text. The harness adds the result to the prompt, tagged with the request it answers: “travel 18% over plan; software 4% under.” The model reads it like anything else in its prompt.
7. 7. Around again, or the answer. If it needs more, the model asks for another tool, say read_file for the detail, and the loop repeats from step 3. When it has enough, it writes its reply, and the harness shows it to the accountant.

Now run the same trip with one change. At step 4, the accountant chooses Deny. Nothing runs. The harness sends back a note saying permission was refused.³ The model reads the note and adapts: it can ask the accountant to share the file another way, or explain what it couldn’t do. Nothing was opened.

Look again at who does what. The model writes at step 3 and step 7, and nowhere else. Every action in the world happens at step 5, and only if step 4 lets it through. So “the AI went and did it” describes the outcome but not the mechanism: a model asked, and software with access acted. In the Replit story, the requests were commands, and nothing between them and the live data said no. The gate at step 4 is the one place in the loop where a person, or a rule a person set, stands between a request and the world.