An agent that uses tools, with a budget that says when to stop.
A tool-using loop that plans, calls, and observes until the job is done, wrapped in cost caps, step limits, and approval gates so it can't run away or act without permission.
Drive it — watch it pause for your approval before it refunds anything, then switch to the stuck task and toggle the budget to see it halt instead of burning money.
Plan, check, act, observe, repeat.
What you just operated is this loop. The loop itself is short and unremarkable. The reason you can leave it running is the guard between planning and acting: every step is checked against the budget and the approval rules before a tool is ever called.
It decides the single next step toward the goal, given everything it's seen so far.
Before acting: is it under budget and step count, and is this step allowed to run unattended?
It calls a tool from the allowlist, with validated arguments. Nothing off-menu.
It reads the result and loops, until the goal is met or a guard stops it.
It returns the answer, or hands off to a human with what it has.
The loop is easy. The budget is the engineering.
Give an agent a task it can't actually finish and it will happily try forever. Same loop, two outcomes: budgeted, it spends up to a cap and then stops and asks a human; unbounded, it keeps calling tools on your dime until something else pulls the plug.
The parts that make it safe to leave running.
An agent that can call tools can do damage at machine speed. The guardrails aren't a feature bolted on later, they're the reason you can trust it unattended.
A hard ceiling on spend and iterations per task. It can't quietly rack up a bill in a loop.
It can only call the tools you granted, with the arguments you allow. No surprise capabilities.
Anything that spends money, emails, or writes to production pauses for a human yes.
Sensitive fields are stripped before they ever reach the model or the logs.
Every plan, call, and result is recorded, so a bad run is debuggable, not a mystery.
A hung tool is abandoned, a flaky one retried with backoff, never left to stall the run.
An agent is a tool loop with good judgement about when to stop, not a mind.
The impressive part isn't that it can plan and call tools. Plenty can. The part that decides whether you can actually leave it running is the boring scaffolding around the loop: the cap that stops it spending, the allowlist that stops it reaching, the approval gate that stops it acting without you, and the trace that lets you see exactly what it did. We build the loop, and we build the fence, because a capable agent without the fence is a liability, not a product.
An agent you can leave running, because it knows its limits.
A tool-using loop under hard cost and step caps, a tool allowlist, approval gates on anything with side-effects, and a full trace of every run.