How it works
An agentic system replaces a one-shot request/response with a loop. You give it a goal and a set of tools, and a model decides what to do next based on what it has seen so far. The cycle repeats until the goal is met or a stop condition fires.
The loop is roughly:
- Read state — the goal, the history so far, and any tool results returned last turn.
- Decide — the model chooses the next action: call a tool, ask a question, or declare the task done.
- Act — the harness executes that action against real systems (a shell, an API, a database, a file).
- Observe — the result is fed back into context as the next input.
- Repeat or stop — continue, or halt on success, error, or an exhausted iteration budget.
Two properties define the category. It is goal-directed: nobody scripts the intermediate steps, so the trajectory is chosen at runtime. And it acts: tools let it change external state, not just emit text. That second property is what turns a clever text generator into something with real blast radius — and what makes the surrounding harness the actual engineering problem.
Why it matters in an agent harness
Once a system chooses its own steps and touches real tools, correctness stops being a property of a single output and becomes a property of the whole trajectory. You can no longer eyeball one response and ship it. This is why agentic AI and harness engineering are the same conversation.
The autonomy you gain is paid for in control you now have to re-establish deliberately:
- Permissions. An agent that can call tools can call the wrong one. Least privilege and scoped tool surfaces decide what a bad decision is even able to touch.
- Reversibility. Because steps aren't pre-vetted, you need to undo them. Checkpoints, rollback, and idempotent actions turn a wrong turn into a recoverable one instead of a cleanup job.
- Observability. A multi-step run fails somewhere specific. Without a legible trace of decisions and tool calls, you get a bad outcome and no cause.
- Containment. Iteration and tool budgets, sandboxing, and approval gates bound how far a single run can go before a human or a check intervenes.
The harness is what converts raw goal-seeking into an operation you can run unattended and still trust.
Agentic AI vs a fixed workflow
The practical question is rarely "agent or not" in the abstract — it's whether to let a model choose the path or to script it yourself. That choice changes the architecture.
| Fixed workflow (DAG/pipeline) | Agentic system | |
|---|---|---|
| Control flow | Author-defined, static | Model-chosen at runtime |
| Best when | Steps are known and stable | Steps depend on what you find |
| Predictability | High; same path every run | Low; trajectory varies |
| Failure mode | Breaks on unforeseen inputs | Wanders, loops, over-acts |
| Debugging | Trace a known graph | Reconstruct a chosen path |
Use a fixed workflow when you already know the steps — it is cheaper, more deterministic, and easier to trust. Reach for an agent only where the path genuinely cannot be enumerated in advance. Much of what gets labeled "agentic" would be more reliable as a pipeline with one model-driven step inside it.
The Rifty take
We treat autonomy as a cost, not a feature. The interesting number is not how many steps an agent can take unattended, but how small we can make the blast radius of any single step while still reaching the goal. We optimize for reversibility and legibility over speed, and we accept slower, more bounded runs as the price of being able to run them without watching. Give the agent the smallest surface that lets it finish, and keep an operator's carried judgment encoded in the harness — not in the hope that the model behaves.
Common failure modes
- Unbounded loops. No iteration or tool budget, so a stuck agent burns cost and time instead of stopping.
- Over-broad tool access. A single scope covers far more than the task needs, so one bad decision reaches production.
- Silent trajectories. No trace of why each action was chosen, so a failed run is unexplainable after the fact.
- Irreversible acts. Destructive tool calls with no checkpoint or rollback turn a wrong turn into permanent damage.
- Agent where a script would do. Model-chosen control flow on a task whose steps were actually known — paying for non-determinism you didn't need.
- Trusting the goal alone. No approval gate or deterministic verifier on the exit, so "the model said it's done" becomes the only check.
Frequently asked questions
What makes a system agentic rather than just an LLM call?
Two properties: it is goal-directed and it acts. Instead of answering one prompt, it chooses its own intermediate steps at runtime and calls real tools that change external state, feeding each result back in. A single request/response with no tools and no loop is not agentic, however capable the model.
When should I use an agent instead of a fixed workflow?
Use an agent only when the steps genuinely can't be enumerated in advance — the path depends on what the agent discovers. If you already know the sequence, a scripted pipeline is cheaper, more deterministic, and easier to trust. Many 'agentic' tasks are better as a pipeline with one model-driven step.
Why is agentic AI a harness problem, not just a model problem?
Because a better model still chooses its own steps and touches real tools. Correctness becomes a property of the whole trajectory, not one output. Permissions, reversibility, observability, and containment all live in the surrounding harness — which is what turns raw goal-seeking into an operation you can run unattended.
What are the main ways agentic systems fail?
Unbounded loops that burn cost, over-broad tool access that widens blast radius, silent trajectories you can't debug, and irreversible actions with no rollback. The subtler failure is using an agent where a script would do — paying for non-determinism on a task whose steps were actually known.
How do I keep an autonomous agent controllable?
Bound it deliberately. Scope tools to least privilege so a bad decision can touch little, add iteration and tool budgets so runs can't wander forever, checkpoint before destructive acts so wrong turns are reversible, and gate the exit with an approval or deterministic verifier rather than trusting the model's own 'done'.