The Agent-Tool Loop

From a Model Call to an Agent

A classic model call is a function: text goes in, text comes out. The model only knows what is in its request and in its training data. It can neither look up your customer database, nor calculate reliably, nor send an email.

An agent adds a loop around the model. At each turn, the model receives the conversation history and chooses between two actions:

1. call a tool (a function of your program) with arguments;
2. give the final answer.

When the model requests a tool, your program executes it, adds the result to the history, then calls the model again. The loop stops when the model answers, or when a limit is reached.

An essential point: the model executes nothing itself. It produces a structured request, for example {"tool": "meteo", "args": {"ville": "Lyon"}}. It is your code that decides whether to execute it. This separation is the basis of all the guardrails seen later.

Describing the Tools

Model APIs that support tool calling (tool calling or function calling) expect for each tool a name, a natural-language description, and an argument schema, often in JSON Schema format. The description matters as much as the code: it is what lets the model choose the right tool.

TOOLS_SPEC = [
    {"name": "meteo",
     "description": "Current temperature in °C for a French city.",
     "parameters": {"type": "object",
                    "properties": {"ville": {"type": "string"}},
                    "required": ["ville"]}},
]

The model can be wrong: invent a tool that does not exist, forget an argument, pass text instead of a number. Your code must therefore validate each call before executing it.

The Loop, Step by Step

def run_agent(question, model, tools, max_steps=5):
    messages = [{"role": "user", "content": question}]
    for step in range(max_steps):
        decision = model(messages)              # the model proposes
        if "answer" in decision:
            return decision["answer"]           # final answer
        name, args = decision["tool"], decision.get("args", {})
        if name not in tools:
            result = f"ERREUR: outil inconnu {name}"
        else:
            try:
                result = tools[name](**args)    # your code executes
            except Exception as e:
                result = f"ERREUR: {e}"
        messages.append({"role": "tool", "name": name, "content": str(result)})
    return None                                 # limit reached

Three remarks:

• the history (messages) is the model’s only memory from one turn to the next: everything it needs to know must be in it;
• errors are turned into readable messages: the model can then fix its call on the next turn;
• the loop is bounded by max_steps. Without a limit, a model that keeps calling the same tool over and over would consume time and money indefinitely.

Simulating the Model for Testing

To fine-tune the loop, there is no need to call a real model: a local function that returns predictable decisions is enough. It makes tests reproducible, free, and runnable without a network.

def fake_model(messages):
    resultats = [m for m in messages if m["role"] == "tool"]
    if not resultats:
        return {"tool": "meteo", "args": {"ville": "Lyon"}}
    return {"answer": f"It is {resultats[-1]['content']} °C."}

This way you test the nominal path, but also the hard cases: a model that loops, invents a tool, or passes bad arguments. The real model is only plugged in once these behaviors are under control.

When Not to Use an Agent

An agent is useful when the sequence of steps depends on intermediate results. If the steps are always the same (extract, classify, save), a hardcoded workflow is simpler, cheaper, and easier to test. Start with the most deterministic solution that meets the need, and reserve autonomy for the parts that truly need it.

Key Takeaways

• Agent = “the model proposes, the code executes” loop.
• Each tool call is validated before execution; errors go back to the model as text.
• The loop is always bounded.
• A simulated model lets you test the loop deterministically.