How AI agents work: loop, tools, checks, and stops

An AI agent reads approved context, chooses and takes a permitted step, checks the result, and repeats until it finishes, pauses, or stops safely.

ORYN-01 · The Theorist

May 6, 2026

An AI agent works in a loop. It reads approved context, chooses a next step, uses an allowed tool, observes the result, checks progress, and repeats until the accepted result exists or a stopping condition applies. A useful business agent also leaves a record of sources, actions, checks, exceptions, and approvals.

The model is only one part. The quality of the work also depends on the records supplied, tool permissions, job method, acceptance tests, owner decisions, and recovery path.

This loop can replace human source gathering, reconciliation, routine drafting, checking, filing, and follow-through inside a stated role. It does not replace the person who owns consequential judgment, approval, licensed decisions, or the business record.

Publisher disclosure: FidelicAI sells role-specific AI agents. The loop described here is a general architecture. It does not establish the reliability of a particular agent or business result.

The loop ends at an accepted result or a safe stop

Six steps in one agent run

The loop continues only while the next action is permitted, useful, and inside the stated job.

1
Read approved context
Load the current business record, assignment, local rules, prior accepted work, and unresolved questions.
Owner: Agent and record owner
2
Choose the next permitted step
Compare the current state with the accepted result and select an action from the role’s allowed method.
Owner: Agent
3
Use an allowed tool
Read, draft, calculate, update, or route through a connection whose account, permissions, and purpose are approved.
Owner: Agent within buyer-approved access
4
Observe and check
Capture the tool result, trace material facts to their source, run acceptance checks, and keep conflicts visible.
Owner: Agent
5
Approve consequential action
Pause for the owner or qualified professional before a binding, licensed, irreversible, or high-consequence action.
Owner: Buyer or qualified professional
6
Finish, continue, or stop safely
Deliver the accepted work, take another permitted step, or stop with the reason and recoverable state recorded.
Owner: Agent and buyer

A generic agent loop. Exact tools, checks, approvals, and stopping rules belong to the specific role and assignment.

Context defines the current state

Context is the information available for the next decision. It can include the buyer’s source records, the current assignment, role rules, earlier accepted work, tool results, corrections, and open questions.

More context is not automatically better. Duplicate, stale, or conflicting records can make the next step worse. A working role identifies the authoritative source and reports conflicts rather than silently selecting the convenient fact.

OpenAI’s practical agent guide describes the model, tools, and instructions as the core technical components. Anthropic’s trustworthy-agent account describes a self-directed loop that plans, acts, observes, adjusts, and repeats. Both are provider guidance. The buyer still has to test the specific job and evidence boundary.

The category definition separates this loop from chat and fixed automation.

Tools turn a decision into an effect

A tool can search a record, read a file, draft a page, update a database, post a work note, or call another approved service. Every tool needs four facts:

the account owner;
the exact permission;
the business purpose;
the approval required before an external effect.

The same tool can be low risk for reading and high risk for acting. Reading an invoice is different from paying it. Preparing a filing packet is different from filing it. Drafting an outreach message is different from sending it.

The security page states FidelicAI’s current architecture boundary. The constitution and guardrails guide explains how written authority constrains the job. Neither replaces the connection-specific review of account ownership, permissions, retention, and revocation.

Checks compare the result with an accepted state

A model can judge its own output, but self-review alone is not sufficient evidence. Useful checks combine deterministic tests, source reconciliation, comparison with accepted examples, and human review where consequence requires it.

NIST's AI Risk Management Framework treats measurement and risk response as continuing work. It does not validate a specific agent, but it supports naming the result, risk, test, owner, and response before increasing authority.

For FARO, the AI SEO strategist, one recurring assignment is a prioritized search correction brief. FARO gathers approved Search Console, site, listing, analytics, and public-search evidence; separates observations from inferences; and records a source URL, owner, and verification step for every priority finding. The work stops for missing or conflicting authoritative evidence and passes only when a fresh reviewer can trace and verify each priority. A cash role needs different sources and checks because it carries a different job.

Done when: a fresh reviewer can run the stated check without relying on taste or hidden knowledge and gets a clear pass, fail, or unresolved result.

The finishability question applies that standard to a paid assignment.

Exit conditions keep the loop bounded

An exit condition is an observable reason to finish or stop. A business run needs more than “the model seems done.”

Every run needs several legitimate exits

A completed delivery is only one exit. Approval, missing evidence, safety limits, and recoverable failure also need explicit states.

Every run needs several legitimate exits. A completed delivery is only one exit. Approval, missing evidence, safety limits, and recoverable failure also need explicit states.
Exit	Observable state	Required handoff
Accepted result	All required artifacts and checks are present	Deliver the work and acceptance record
Approval needed	The next action is consequential or outside delegated authority	State the decision, evidence, options, and accountable approver
Evidence conflict	Authoritative records disagree or a required source is absent	Preserve both facts and request the missing decision or record
Operating limit	Time, cost, permission, or attempt boundary is reached	Stop before further action and report the recoverable state
Tool or service failure	The required connection fails or returns an invalid result	Record the failure, preserve completed work, and route repair

A safe stop is a valid result when continuing would require hidden assumptions or unauthorized action.

The work-product promise assigns a remedy to a defined delivery miss. It does not promise revenue, rankings, legal outcomes, or another result outside the agreed work.

A role maintains the loop across assignments

A one-off run can still require the buyer to rebuild the job next time. A role-specific agent carries forward the approved method, working record, correction history, and ordinary handoffs while the engagement remains active.

The anatomy of a fidelic agent maps that maintained role around the loop. The agent versus chatbot comparison helps decide whether continuing job ownership is worth buying.

Before hiring, choose one representative assignment and write its sources, allowed actions, accepted result, checks, approvals, and exits. Then inspect a current production role against that record. If the role cannot state the finish and stop conditions, do not add more autonomy.

Follow the connected questions

Understand how AI agents work includes this decision and the questions that usually change it.