The loop, in four lines
until the job is done: read the job and everything so far pick the next step, or a tool to call run the tool, add its result
The model only ever writes text. The loop and the tools are ordinary software around it.
01/ 10
An agent is a model in a loop
A language model does one thing: given some text, it writes the next text. On its own it cannot read your calendar or send an email.
An agent is that model put in a loop with tools. It reads the job, decides a next step, asks the software around it to run a tool, reads the result, and goes round again until it decides the job is done.
02/ 10
A job arrives
A guest emails a small homestay. She wants to move her dates, and get the difference back if the new nights are cheaper.
A person would take five minutes: find the booking, check the room, work out the price, write back. The agent does the same steps, out loud.
03/ 10
It writes itself a plan
The first thing the model writes is usually a plan: a short list of steps. It is just text, but it steers what comes next.
Notice that it plans with what it has read. Whatever is in the email becomes part of its thinking. That matters in scene 8.
04/ 10
It calls a tool
The model can't open the booking system. Instead it writes a request in a fixed shape, like
find_booking(guest, room). The software around it runs that request and pastes the answer back in.Which tools exist, and what each one is allowed to touch, is decided by the people who build the agent. That is the first safety switch.
05/ 10
It reads the result and goes round again
Each result becomes part of the text the model reads next, so it can choose the next call: is the room free, what do the new nights cost.
Research calls this pattern reasoning and acting: think a step, act, look, think again. Three tool calls here; a big job might take dozens.
06/ 10
It drafts
When it thinks it has enough, the agent writes the reply and the changes it wants to make: move the booking, refund the difference.
Here is the rule we build everything on: this is a draft. Nothing has been sent and no money has moved. Violet, on our screens, always means a draft.
07/ 10
A person checks
The draft goes to a person, with the evidence beside each claim: which tool said the room is free, where the refund amount came from.
Checking takes seconds when the evidence is shown. Approve it, or send it back with a note. Try both on the stage.
08/ 10
Now break it
Plant a problem, switch the approval step off, and run the agent again. Then try the same problem with approval on.
09/ 10
Why it goes wrong
None of these needs a bad model. A tool times out and the model writes a plausible guess. An email carries instructions, and the model follows them, because to a model all text is just text. Security people call this prompt injection, and list it first among the risks of AI applications.
The third problem is the multiplier: an agent that can press the refund button itself turns every slip into money gone. They call it excessive agency.
10/ 10
Then it acts, and leaves a receipt
Only after a yes does the software carry out the action. Then it writes a receipt: what was asked, what was drafted, who decided, and the evidence.
It is how INDRA works: agents draft invoices and replies, people approve, and every action leaves a signed receipt. Open the live demo, or see how receipts prove they were never changed.