An agent loop is a control plane. Every tool call should be authorized and every run should terminate within explicit economic and operational limits.
Bounded Agent Execution
A model proposes actions; deterministic policy owns authority, limits, and termination.
const budget = { steps: 12, tokens: 24_000, toolMs: 30_000, spendUsd: 0.40 }
for (const step of plan) {
const reservation = usage.reserve(step.maximumUsage, budget)
authorize({ actor, tool: step.tool, resource: step.resource })
if (isIrreversible(step)) await requireApproval(runId, step)
const result = await execute(step, { timeoutMs: reservation.toolMs })
usage.settle(reservation, result.usage)
audit.append({ runId, step, result: redact(result) })
}Invariant: No step starts without reserved budget and authorization for its exact tool and resource.
Use when: An agent can call tools and needs explicit economic and safety limits.
Why this boundary matters
Agent loops can compound tool calls, cost, and irreversible effects. Authority and resource ceilings must remain outside model control.
Failure policy
| Boundary | Action |
|---|---|
| Within all budgets and authorized | Execute the next tool step and audit it |
| Step, token, time, or spend budget exhausted | Stop with an explicit terminal outcome |
| Tool or resource unauthorized | Deny without asking the model to override policy |
| Irreversible or high-impact action | Require deterministic approval |
| Tool outcome is ambiguous | Reconcile by stable operation ID before retrying |
Trade-offs
Tight budgets contain cost and blast radius but can truncate useful work. Broad tool access improves autonomy while increasing security and recovery burden. Human approval adds latency but creates a deliberate boundary for irreversible effects.
Decision rule: Grant the minimum authority and budget needed for one run, and require deterministic controls around consequential actions.
Further reference
Browse all engineering snippets · Read about agent control planes