Many agent demos begin with the same shape: give a model a goal, let it call a tool, inspect the result, and repeat. That loop can look intelligent within minutes. Production changes the question. What happens when the process crashes after charging a card, waits three days for approval, receives the same callback twice, or resumes after the underlying data has changed? At that point the product is no longer just a model with tools. It is a runtime.
A dependable agent runtime preserves explicit state, checkpoints progress, makes side effects idempotent, separates tool permissions, pauses for human judgment, and records enough evidence to replay and evaluate the run. The goal is not an agent that never stops. It is an agent that can stop safely and continue correctly.
The loop is the easy part
A loop explains how an agent thinks next. It does not explain how the system owns time. Real work stretches across network calls, rate limits, hand-offs, approvals, retries, and partial failure. A research agent may wait for a source. A deployment agent may need an operator to approve a migration. A service workflow may have to recover without repeating an external action.
This is why current agent infrastructure is moving toward explicit long-running tasks. The July 2026 Model Context Protocol specification introduced a Tasks extension for work that can be deferred and retrieved later. That direction matters because duration and resumption are becoming protocol concerns, not application-specific tricks.
The agent loop chooses the next action. The runtime makes that action survivable.
State must survive the process
If a run can resume, its state must be serialisable and inspectable. Store the current plan, completed steps, tool results, approvals, outstanding risks, and the version of the instructions that shaped the decision. Do not rely on a reconstructed conversation as the only record of what happened.
Checkpoints create a clean recovery boundary. Frameworks such as LangGraph treat persistence and durable execution as first-class capabilities: a workflow can save progress, pause, and continue from an earlier state. The architectural lesson is broader than any framework. A process should be able to answer three questions after restart: what has definitely happened, what may have happened, and what is safe to do next?
State also needs a schema. A typed decision, an external receipt, and an unverified model inference should not all be stored as anonymous text. Their authority and expiry rules are different. Structured state makes those differences visible.
Tools need boundaries
Resumption turns every side effect into a design problem. If the agent crashes after a tool succeeds but before the checkpoint is written, a retry may send the email again or create a second record. Idempotency keys, stable operation IDs, and read-before-write checks turn ambiguous retries into controlled behaviour.
Tool permissions should also be narrow. Reading a document, drafting a message, and sending it are three different capabilities. Give the workflow the least authority required for its current step. Record the arguments, result, latency, and error class for each call. A useful trace explains not only what the model said, but what the system changed.
Determinism matters during replay. Durable workflow guidance recommends isolating non-deterministic work and making side effects idempotent so a resumed run does not silently choose a different path or duplicate an action.
Human judgment should be a checkpoint
Human in the loop should not mean watching a chat window and hoping someone intervenes in time. It should be an explicit state transition. The workflow pauses with a concise decision packet: proposed action, evidence, uncertainty, expected impact, and the options available to the reviewer.
The reviewer can approve, edit, reject, or redirect. Their response becomes durable state, and the agent continues from that decision. Interrupt-based workflows demonstrate this pattern by checkpointing state before the pause and resuming with a structured value afterward.
Reserve checkpoints for material choices: destructive actions, external communication, financial changes, policy exceptions, or decisions with weak evidence. Too many approvals turn the operator into a manual router. Too few make the agent powerful without making it accountable.
Evaluate the journey
A correct final answer can hide a broken process. The agent may have selected the wrong tool, ignored an approval condition, retried an unsafe action, or used stale state and still reached a plausible result. Evaluation must cover the trace as well as the outcome.
Build datasets from representative tasks and failure cases, then score task completion, tool selection, state accuracy, recovery behaviour, approval compliance, cost, and latency. OpenAI's evaluation API reflects the same basic discipline: define the data source and the criteria before treating a run as evidence of quality.
Include interruption tests. Stop the workflow before and after every external action. Duplicate a callback. Change a permission while the run is paused. Resume with new data. A reliable runtime should fail clearly, preserve evidence, and avoid turning uncertainty into repeated side effects.
A practical production checklist
- Explicit state: plans, results, decisions, and risks have a versioned schema.
- Durable checkpoints: work can resume without replaying the entire conversation.
- Safe effects: external writes use idempotency keys or equivalent deduplication.
- Narrow tools: read, draft, approve, and execute permissions are separated.
- Human gates: high-impact choices pause with enough evidence for a real decision.
- Observable traces: every tool call and state transition can be inspected.
- Journey evals: success includes recovery, policy compliance, cost, and latency.
The interesting future of agents is not endless autonomy. It is dependable delegation. A strong agent runtime lets software work for longer while remaining interruptible, inspectable, and bounded. That is how a promising loop becomes infrastructure a team can trust.