Every agent framework, under the naming, is the same four steps repeated.
The four steps
1. Perceive. Gather the current state: the goal, what has happened so far, results of previous actions, and any relevant context.
2. Decide. The model is given that state and the list of tools available, and produces one of two things: a request to use a tool with specific arguments, or a final answer meaning it is done.
3. Act. Something outside the model executes the requested tool and captures the result — including failures.
4. Observe. The result is added to the accumulated state, and the loop returns to step one.
Where the model is, and is not
This is the most commonly misunderstood part, and it matters for security.
The model never executes anything. It emits a structured request — "call send_email with these arguments". Your code receives that request, decides whether to honour it, executes it, and returns the outcome as text.
Everything in between is yours: validation, permission checks, rate limits, approval gates, logging. The model proposes; your system disposes. That gap is where every safety control lives, and an agent with no code in that gap has no controls at all.
Why loops fail to end
No success condition. The most common cause. If "done" is never defined, every observation suggests another reasonable step. The agent is not malfunctioning — it genuinely cannot tell it has finished.
Repeating a failing action. A tool returns an error, the model tries the same call again, and again. Without a rule that notices repetition, this can continue indefinitely.
Goal drift. In a long run, the original goal moves further back in the context while recent tool results dominate. The agent gradually starts optimising for something adjacent to what you asked.
Standard containment: a hard maximum on iterations, a wall-clock timeout, duplicate-action detection, and re-stating the goal on every iteration rather than relying on it surviving in history.
Cost grows with steps
Each iteration sends the accumulated history back to the model. A ten-step run does not cost ten times a one-step run — it costs more, because the context grows at every step. This is why step limits are a budget control as much as a safety one.
The practical takeaway
When an agent behaves badly, ask which step broke. Wrong action chosen → the decide step, usually a tool description problem. Right action, bad arguments → also decide, usually a schema problem. Action failed silently → the act step swallowed an error. Never stopped → no success condition. The four steps are a diagnostic tool, not just a diagram.