Generative AI / Intermediate: retrieval and controlled workflows / Lesson 11
Agents, control flow, and stopping
Design bounded propose-check-act-observe loops with explicit state and evidence rather than treating an autonomous-looking transcript as reliable completion.
On this page
Lesson goals
- Explain the assumptions and trust boundaries of agents, control flow, and stopping.
- Interpret both examples and distinguish offline fixture results from model or production evidence.
- Diagnose the listed failures and justify the worked decisions while preserving task, data, permission, and uncertainty contracts.
Define agency in application terms
An agentic system can select intermediate steps or tool proposals while pursuing a task, but the degree of autonomy is a design choice. A fixed workflow with one generation step and a dynamically planned loop have different risks and evaluation needs. Name the user goal, allowed capabilities, trusted state, stop conditions, and escalation path. The first offline example consumes a fixed list of proposed actions under a small step budget. It is a control-flow fixture, not a language model or an autonomous worker. No real planning quality, task success, or external capability is demonstrated by the transcript.
proposals = ["lookup", "compare", "summarize"]
step_limit = 2
recorded = []
for proposal in proposals:
if len(recorded) >= step_limit:
break
recorded.append(proposal)
print(recorded)
print("stopped_at_budget" if len(recorded) < len(proposals) else "finished_fixture")
['lookup', 'compare']
stopped_at_budgetTwo fixed proposals are recorded and the third is not processed. No action is executed, and stopping at budget is not reported as task success.
Separate proposal, approval, effect, and observation
A plan describes possible work; a policy check authorizes a specific action; a tool performs an effect; an observation records what actually happened. Keep these states distinct. A model statement that a task is done is not proof that a transaction committed or a message was delivered. The second predicate requires both task evidence and policy success before a synthetic completion is released. In a real system, approvals must bind to exact reviewed arguments and resources. Human review should provide relevant information and a meaningful decision, not merely a button that rubber-stamps whatever the model proposed.
def release(model_says_done, evidence_ok, policy_ok):
if not policy_ok:
return "denied"
if model_says_done and evidence_ok:
return "complete_fixture"
return "needs_review"
print(release(True, False, True))
print(release(True, True, False))
print(release(True, True, True))
needs_review
denied
complete_fixtureA narrative completion claim alone does not pass. Evidence and trusted policy are independent inputs in this synthetic gate and are not supplied by a real model.
Bound every accumulating resource
Set limits for steps, tool calls, retries, elapsed time, queued work, context growth, and data exposure. A step limit alone does not control one expensive call or a huge returned document. Preserve a total operation budget across nested loops instead of resetting it whenever the model changes its plan. Detect repeated nonprogress under an explicit policy and escalate or stop without inventing success. A limit failure differs from an authorization denial or an insufficient-evidence answer and should remain visible. Example budget numbers here are fictional and not universal safe defaults for any real agent or runtime.
Manage memory and recovery explicitly
Agent history can contain stale hypotheses, rejected actions, untrusted tool text, and sensitive values. Store only necessary state with provenance, retention, and access controls. A summary must not convert an unverified earlier statement into a trusted fact or approval. If a process fails after an external effect, resuming from the last model message can repeat the action. Use durable operation identity, verified tool outcomes, and reconciliation appropriate to the actual service. Keep actor and tenant scope outside the model’s editable narrative so a plan change cannot silently expand permissions or switch the target user.
Evaluate complete trajectories and failure exits
Measure whether the correct authorized task completed with supported evidence, bounded resources, and acceptable recovery, not merely whether a plausible plan was written. Include partial tool failure, repeated proposals, missing evidence, conflicting observations, and injection-bearing data in controlled fixtures. Compare simpler workflows as a baseline because added autonomy can increase cost and uncertainty without improving the outcome. These examples run no model, tool service, scheduler, network, or background process. Primary agent research motivates designs and evaluation questions in its studied settings; it does not certify a new application’s safety, correctness, or ability to stop.
Common errors and fixes
A polished plan is reported as completed work
- Why it happens
- Proposal and observed effect were conflated.
- How to fix it
- Require verified operation outcomes and task evidence.
- Prevent it next time
- Track plan, authorization, action, and observation separately.
Nested loops reset the budget
- Why it happens
- Limits were local while work accumulated globally.
- How to fix it
- Carry an overall operation budget across transitions.
- Prevent it next time
- Test retries and replanning against total limits.
Resume repeats an already completed external action
- Why it happens
- History was used instead of durable execution evidence.
- How to fix it
- Reconcile operation identity and actual outcome before repeating.
- Prevent it next time
- Test interruption after effect before state persistence.
Check your understanding
1. The model writes done but the tool result is missing. Should the application report success?
Show worked solution
No. Preserve an uncertain or review state and reconcile the actual operation under the application contract. The narrative is not independent execution evidence. Do not repeat a side effect blindly or invent a successful result to complete the conversation.
2. Why can a fixed workflow outperform an agent loop for a simple extraction task?
Show worked solution
It can have fewer variable decisions, lower overhead, clearer validation, and easier recovery while satisfying the same requirement. Evaluate useful outcomes and resource cost rather than assuming more autonomy is inherently more capable or valuable.
Key takeaways
- An agentic system can select intermediate steps or tool proposals while pursuing a task, but the degree of autonomy is a design choice.
- Set limits for steps, tool calls, retries, elapsed time, queued work, context growth, and data exposure.
- Measure whether the correct authorized task completed with supported evidence, bounded resources, and acceptable recovery, not merely whether a plausible plan was written.