Design the agentic control loop before selecting the framework

Start with the state machine

Before choosing an agent framework, write the allowed states and transitions. Identify which events move the workflow forward, which events require a human, and which conditions terminate or suspend the run. This exposes ambiguity that prompt engineering cannot resolve.

A state machine also prevents accidental authority expansion. If execution is not a valid transition from the current state, the model cannot create that permission through persuasive output.

Observe

Observation is the controlled acquisition of current state. The system should retrieve only the data authorized for the user, task, tenant, and environment. Observation should distinguish current facts, historical records, inferred context, and missing evidence.

• Record source identifiers and retrieval time
• Apply access policy before content enters model context
• Classify data sensitivity and retention
• Detect stale, conflicting, or superseded evidence

Interpret and plan

Interpretation creates a bounded problem representation. Planning proposes steps, dependencies, tools, expected effects, and stop conditions. These steps can be combined in a small system, but separating them during design helps teams see whether the system is reasoning from evidence or merely extending a prior plan.

Plans should be treated as proposals. A plan may contain unsupported assumptions, over-broad tool use, or a sequence that becomes invalid after the environment changes.

Authorize

Authorization belongs outside the model. The application should evaluate identity, role, task scope, policy, data classification, environment, value limits, time limits, and required approvals before permitting a tool call.

The authorization decision should be recorded with the policy version and reason. This is especially important when standing authority expires or when a human exception allows a one-time action.

Act and verify

A successful API response does not prove the intended business effect occurred. Verification checks the authoritative system, reconciles identifiers, detects partial completion, and records side effects.

For retryable work, the system needs stable idempotency keys or a reconciliation strategy. For irreversible work, it may need a proposal artifact and separate human execution rather than direct tool use.

Remember

Memory should preserve workflow progress and evidence without turning every prior output into a trusted instruction. Store business state in authoritative systems, workflow state in durable execution, episodic traces in evidence records, and reusable knowledge with provenance and supersession.

Stop, wait, refuse, and escalate

Stopping is a capability. The loop should know when the goal is complete, the budget is exhausted, evidence is insufficient, policy blocks the action, the environment is unsafe, or human review is required.

The stop path should remain available when the agent, model provider, tool server, or shared state is degraded. A global circuit breaker that depends on the same failing control plane is not a reliable stop mechanism.

Evidence for each transition

Each transition should produce a compact record: prior state, triggering event, relevant evidence, decision or policy result, tool request, tool effect, new state, and unresolved conditions. This enables trace-level evaluation and operational review.

NIST's agentic evaluation work is relevant because it examines behaviors and manipulation across the trajectory rather than relying only on final-answer scores. [S2] [S3]

Research boundary

This control loop is a review pattern, not a formal standard. Implementations should be adapted to consequence, latency, privacy, and operating environment. High-consequence systems require independent security and domain review.