An LLM by itself is a function that maps tokens to tokens. An agent is that function wrapped in a loop with the ability to call tools — search, code execution, an API, a database — and read the results back into context. The loop ends when the model decides the task is done or when it hits a budget.
The ReAct pattern
Yao et al. 2022: prompt the model to alternate between Thought (reasoning) and Action (tool call). After each Action, the runtime executes the tool and returns Observation. The model continues. This was the breakthrough that turned LLMs into agents capable of multi-step tasks.
Question: What was Safaricom's revenue in FY24?Thought: I need to look this up in their annual report.Action: search("Safaricom annual report FY24 revenue")Observation: Safaricom Annual Report 2024 cites total revenue of KES 335.4bn...Thought: I have the figure. Final answer.Answer: KES 335.4 billion.
Function calling
Modern model APIs (Claude, GPT, Gemini) have native function-calling: you describe available tools as JSON schemas, the model decides which to call and with what arguments, the runtime executes them and returns the results. Cleaner than ReAct prompting; same idea.
Bounded loops
Agents can spin. Set a maximum iteration count (10-30 is typical), a token budget, or an explicit halt condition. Production agents need observability: log every Thought, every Action, every Observation. When things go wrong, you read the trace.
Tool design
- Few tools, well-defined. Two-dozen tools usually outperforms two-hundred
- Idempotent where possible — retrying a tool shouldn't have side effects
- Rich error messages — the model can recover from 'No results found for query X, try a different query' but not from 'Error'
- Bounded outputs — truncate tool results that would blow the context budget
Computer use
The 2024 frontier: agents that see a screen, move a mouse, type. Anthropic's Computer Use and OpenAI's Operator open this up. Useful for legacy systems that have no API; expensive and slow compared to direct API calls. Production use cases are narrow but real (web automation, data entry, QA testing).
Why agents are still risky in production
An agent that can search the web, write code, and execute it is also an agent that can be social-engineered, prompt-injected, or simply mistaken. Production deployments need: tight tool scope, human-in-the-loop for irreversible actions, observability, and explicit halt criteria.
Exercise
A trading firm is designing an autonomous agent that monitors news feeds, identifies market-moving events, and places equity trades within defined limits. Sketch the architecture: (1) what tools should the agent have, (2) what guardrails should constrain it, (3) at what points should a human approve before action, and (4) what telemetry / logging is non-negotiable?