Agentic AI: how an agent's loop works

The word “agentic” has settled into software vendors’ announcements, often without any explanation. Behind it, though, there is a mechanism that is simple to describe, and that mechanism decides whether an agent will be reliable or merely expensive: the loop. This guide, from our Business AI: private and at the right cost section, takes the loop apart piece by piece, then shows two loops that we run ourselves. For the definition of an agent and what separates it from a chatbot or a workflow, start with AI agent: what it is, and what it is not. To place agents within a wider AI project, our guide to integrating AI in business takes the decisions in order.

What is agentic AI?

We speak of agentic AI when a language model no longer just answers a request but itself conducts a series of actions to reach a goal: looking up a piece of information, calling a piece of software, correcting what did not work. The mechanism is less mysterious than the word. In Building effective agents, published in December 2024, Anthropic, which develops the Claude models, describes agents as follows:

What changes, then, is not the model but what it is allowed to do. A conventional generative AI produces an answer and stops. An agent produces an action, looks at what came of it and uses that to decide on the next one. The whole design of an agentic system comes down to how that loop is built, braked and monitored.

How does an agent’s loop work?

In September 2025, when presenting its agent development kit, Anthropic summed up an agent’s loop in four steps: gather context, take action, verify work, repeat. Take a simple request, received by email: a customer wants to change the delivery address on their order.

The agent does not guess: it goes and fetches what it needs in the management software, with the tools it has been given. And if the order is locked or the address incomplete, the verification fails and it starts again with that information.

The third step is the most important: reading again, instead of assuming the call succeeded. In its 2024 text, Anthropic insists that an agent must gain “ground truth” from its environment at each step, such as the result of a tool call or the execution of code, to assess its progress. An agentic loop that verifies nothing chains one assumption after another, and an error from the first turn is carried into every later one.

How does an agent verify its own work?

There are several ways to close the loop, and they are not equal. The September 2025 article distinguishes three:

• Written rules. “The best form of feedback is providing clearly defined rules for an output, then explaining which rules failed and why.” An expected format, a required field, a test that passes or fails: the answer is clear, and the agent knows what to correct.
• Visual feedback. For an interface or a formatted document, a screenshot makes it possible to check what a human would see.
• A second model acting as judge. One model can assess another’s work against fuzzier criteria, such as the tone of a text. This is generally less robust, Anthropic notes, and it adds response time.

The 2024 text describes the same idea under the name evaluator-optimizer: one model call produces a response, another evaluates it and sends back its comments, in a loop. This pattern is most effective, it adds, when the evaluation criteria are clear and each round of correction brings a measurable gain. In other words, if you cannot write down what a good result is, the loop will not know it any better than you do.

When should the loop stop?

A loop with no end is not a harder-working agent: it is a growing bill and errors that pile up. Anthropic notes that it is common to add stopping conditions, such as a maximum number of iterations, to keep control. Four brakes work together:

• a number of turns beyond which the agent hands control back;
• a budget per task, in model calls or in euros;
• a success criterion written in advance, which the verification can recognise;
• stopping when blocked: when the agent can no longer progress, it stops and says why, instead of improvising.

The principle holds outside AI too: a loop with no brake multiplies the error instead of correcting it.

What safeguards should surround an agent’s loop?

An agent acts with the tools it is entrusted with. The risk therefore lies not only in what it writes but in what it can do. OWASP, a non-profit foundation dedicated to software security, places this risk in its 2025 ranking of the top ten risks for large language model applications, under the name Excessive Agency.

The countermeasures OWASP recommends read like a design checklist:

• give the agent only the extensions strictly necessary for its task;
• reduce to a minimum the permissions these extensions have on other systems;
• have a human approve high-impact actions before they are carried out;
• check authorisations in the target systems, rather than letting the model decide whether an action is allowed;
• limit the rate of actions, so that a runaway loop stays small.

In the order example, that means an agent that can read orders and change an address, but neither refund nor delete; and management software that itself refuses any change to a shipped order, whatever the agent thinks.

The same logic applies to its access keys: an agent does not need to read the ones it uses. A relay can add them at the moment of the call, only towards the intended service, and the model never sees them go by. We explain this principle in our article on the secrets vault.

Where does the human fit in the loop?

“Human in the loop” does not mean a human watching every turn. Anthropic describes agents that pause to get human feedback at checkpoints, or when they run into a blocker. OWASP, for its part, asks for human approval before high-impact actions.

The right question is therefore: which action is irreversible, or commits the company? That is where the human belongs. An agent that asks for approval at every turn is no longer really an agent; one that never asks will eventually publish, pay or delete what it should not have. This division of roles is developed in our article on the role of the human alongside AI.

Two loops that we run

A content loop, every morning

Since early October 2026, a loop has prepared drafts for this blog every morning. It starts from a set of written instructions, always the same, and follows a fixed order:

Its checks are rules, not opinions: a script checks each draft (vocabulary, punctuation, links, structure), then the whole site has to build without errors. It hands over its drafts for review, with a three-part report: what is done, what remains to be decided, the next iteration.

Its brakes are written into the instructions: it never publishes, never adds anything to the site itself, and when it gets stuck, it stops and says so. The only action that puts an article online is human: read it, then approve. These are design choices; we do not yet have enough hindsight to put a figure on the gain.

An SEO engine with four agents

This site’s SEO relies on a different set-up. Every day, a scan that uses no AI reads Google Search Console and builds the work queue. Every week, four agents (keywords, content, refresh, audit) draw on it; the audit does its technical checks on a sample and runs before the writing, and the run delivers two pieces of content at most, as drafts. Its first unattended run, on 30 August 2026, produced nothing: the agent orchestrating it asked a question instead of deciding, and with nobody to answer, a question asked ends the run. Its instructions have forbidden any question along the way ever since. The detail of this set-up is in our guide to the AI agent in production, from demo to product.

What one turn of the loop costs

Every turn is a call to the model, and what it reads grows as the loop advances: the gathered context, the tool results, the checks. Since each turn generally re-reads what came before, the cost of a loop rises faster than its number of turns. The calculation is detailed in our guide to the cost of AI in business.

That is why a well-designed loop does not hand every turn to the same model. Checking a format needs no AI at all, sorting a request is done with a small model, and the large model steps in only where it adds something. We apply this routing everywhere: on Palmora Property, moving translation to a suitable AI model cut its cost by a factor of 60, and 95% of segments are served from a cache, with no call to the model. This is the principle behind our AI at the right cost offer: each task given to the model that is just sufficient, with a budget and caps per use.

Where to start

Before building a loop, look at the task as it is done today: what comes in, what must come out, who checks it and what would be serious in case of error. If you cannot yet write down what a good result is, start there, because it is the condition for verification to work. It is also what we do before recommending anything: look at your workflows, your tools and how they integrate with one another, the team’s obstacles and its training needs. Our digital and AI maturity audit is made for this, with a written GO or NO-GO for each project.

Frequently asked questions

Sources

1. Building effective agents (new tab)anthropic.com
2. Gather context, take action, verify work, repeat (new tab)claude.com
3. Excessive Agency (new tab)genai.owasp.org