AI agent

The loop, drawn small#

observe   →  a mail arrives / a caller speaks / a follow-up falls due
   ↓
ground    →  what does the business already know that bears on this?
   ↓
decide    →  the model proposes: an answer, a tool call, or "I cannot"
   ↓
permit    →  code checks the proposal against rules. Not the model.
   ↓
act       →  the tool runs; the provider answers; evidence is stored
   ↓
record    →  relationship, timeline, audit, usage
   ↓
observe   →  the result is the next observation

Two of those six boxes are the model's. The other four are code, and the quality of an agent in a business setting is decided almost entirely by them. An agent whose *permit* step is a sentence in the prompt asking it to be careful has no permit step.

Three things that make one useful at work#

1. Tools that do real things with real credentials. An agent that can only talk is a search box with a better manner. The interesting risk and the interesting value both start at the first side effect.
2. Grounding in the employer's own material. A general model knows the world; it does not know your delivery times. Answers that cannot be traced to something the business supplied are the largest single source of expensive mistakes.
3. A stopping rule the model does not own. Budgets, allowances, approval gates and refusals belong outside the loop, or the loop decides its own limits — which is the same as having none.

Does Connect use an agent loop?#

Used, and in two distinct places with different shapes. The background engine (agent.py, runner.py) runs the loop above over mail, calls, follow-ups and prospecting: triage, ground, draft, decide. The in-app Connect Assistant runs a shorter, person-initiated loop with a tool set of its own — 66 tools at the last count, each with a schema and its own permission check.

On a live phone call the loop is compressed into the model session itself: a speech-to-speech model listens and speaks continuously and calls Connect's tools mid-sentence. The permit step still sits outside it — every spoken sentence is posted back and re-checked against the guardrails after the fact, and an escalation phrase queues a transfer rather than the model performing one.

The two properties that make an agent dangerous#

Both are structural rather than model-dependent. A better model reduces the rate of bad proposals; it does not change what a bad proposal is allowed to do.

Where the field is being written down#

There is no single standard for what an agent is. Two specifications matter because they standardise the edges: the Model Context Protocol for how an agent reaches tools and data, and the A2A protocol for how one agent addresses another. Connect publishes surfaces for both — see Protocols.

Questions#

Related#

• Agentic workflow
• Tool calling
• Agent and assistant
• How Connect works
• Prompt injection