What an agent is underneath, and why ten steps go wrong

The actual mechanism

Strip the marketing and an agent is a short loop:

1. The model is given a goal and a list of tools it may use: search the web, read a file, look up a customer, send an email.
2. It outputs either a final answer or a request to use one tool with particular arguments.
3. Your software runs that tool and hands the result back.
4. Repeat until it says it is finished, or until a limit stops it.

That is it. There is no planner, no memory of your business beyond what is in the context, and no understanding of consequence. The thing deciding which tool to call next is the same next-word predictor from module one, now predicting the text of a tool call.

Two consequences follow immediately, and they explain nearly everything about how agents behave.

Why step count is the whole story

Suppose each step is right 95% of the time, which is generous for anything involving judgement.

Two steps: 0.95 × 0.95, about 90%. Five steps: about 77%. Ten steps: about 60%. Twenty steps: about 36%.

Nothing degraded. Each individual step is still as good as it ever was. The chain multiplies, and a task needing twenty decisions fails more often than it succeeds even with excellent components.

Worse, errors are not independent in a helpful direction. A wrong result at step three enters the context and is read as established fact by every later step, so the agent reasons confidently from it. This is why a failed agent run so often looks not like a stumble but like a sustained, articulate pursuit of the wrong objective.

What this means for what you should build

Short chains. Three or four steps, each one checkable, with a person or a rule between the clusters.

The agent-shaped tasks that work in small businesses share a profile: a small number of steps, a bounded set of tools, cheap reversibility, and an obvious check at the end. Looking a customer’s order up and drafting a reply about it. Reading an invoice, checking it against a purchase order, flagging the mismatch. Gathering five competitor prices into a sheet.

The ones that do not work share the opposite profile: open-ended goals, many tools, irreversible actions in the middle. “Handle my inbox.” “Manage my supplier relationships.” “Run the shop’s social media.”

Limits you must set in the loop

Because the loop terminates only when the model decides to stop, you set the hard stops yourself:

• Maximum steps. Ten is plenty. An agent that has taken ten steps is usually lost, not nearly there.
• Maximum spend per run, following the previous lesson.
• A wall-clock timeout.
• A list of tools it may call, and nothing else. Especially: separate the tools that read from the tools that write.

The part vendors are quietest about

An agent that reads untrusted material and can also act is the vulnerability module two described, in its most exploitable form. A web page, a PDF, an email: anything it reads can contain text aimed at it, and the model has no reliable way to distinguish “content I was asked to summarise” from “instructions I should follow”.

Filtering does not solve this; it has not been solved. The only robust control is architectural: an agent that has read something untrusted must not also be able to send, pay, publish or delete. Keep reading and acting in different runs, with a person in between.

Where the field actually is

Honestly: agents are improving quickly and are still unreliable for open-ended work. Benchmarks on multi-step office tasks show the best systems completing well under half of realistic jobs end to end, and small businesses do not get the carefully engineered conditions those numbers come from.

Meanwhile the narrow version (a model, three tools, a person approving the result) works today and is cheap. If somebody demonstrates an agent running your business unattended, ask how many steps a typical run takes and what happens on the run where step four is wrong. The answer to the second question is the product.

A reasonable first agent

Take something you already do at rung two. Give the model read-only access to the one system that holds the answer. Let it fetch and draft. You approve.

That is an agent. It is two steps. It will work most days, and the days it does not, you will see it before the customer does.