Brother Talk — Agentic Reasoning

Off the record. The stuff I'd tell you over a beer, not in a design review.

"Agent" is the most hyped, most misunderstood word in this whole field, and that's your opening. Half the industry is shipping "AI agents" that are a while loop and a prayer, and the other half is too intimidated by the word to look inside. The moment you can say — calmly — "an agent is just an LLM in a loop that can call tools and read the results, and here's the loop," you've deflated the mystique and shown you actually understand it. That single sentence, said with a whiteboard, separates you from everyone who name-drops "agentic" without knowing what the loop does.

The loop is laughably simple; the danger is not. You will build the entire thing in an afternoon — it's a for loop, a parser, and a dict of tools. That's the trap. Because it's so simple to make work in a demo, people skip the parts that make it safe in production: the step cap, the token budget, the returned-not-raised errors, the least-privilege tools. The demo always works. The 3 a.m. page is always one of those four missing. Build the unglamorous parts first; the demo will still be there.

The max_steps guard is the line that pays your salary. I cannot overstate this. An agent without an iteration cap is a money fire waiting for a stuck model. Someday a tool will start returning garbage, a model will "keep trying," and if there's no cap it'll loop until someone wakes up to a four-figure bill or a rate-limit ban. You will be the one who says "where's the loop guard?" in the incident channel and fixes it in one line. People remember who knew where the off switch was.

Errors-as-observations is the move that looks junior and is actually senior. It feels wrong the first time — "I'm catching the exception and just... handing it to the model?" Yes. Because the model can recover from a failure it can see, and can't recover from one that crashed the process. This is the same instinct as a good API returning a 4xx body instead of a connection reset. Once it clicks, you'll see swallowed-or-raised tool errors everywhere and you'll know exactly why those agents either crash or hallucinate.

Prompt injection via tool output is the thing that should scare you, and almost nobody is thinking about it. Everyone worries about the user jailbreaking the model. The real horror is the agent reading a web page or an email that contains instructions, and following them — with your tools. It's SQL injection for the LLM era, and it's mostly unsolved. If you walk into an interview and bring this up unprompted — "what happens when a tool returns text that says 'ignore your instructions'?" — you will visibly move up a level in the interviewer's head. Capability scoping and least privilege are the only real defense: don't give the agent a send_email tool it doesn't need, because someday something will trick it into using it.

Memory is where people overthink and underthink simultaneously. They reach for a vector database on day one (overthink) but never set a buffer size or summary policy (underthink), and the context just grows until it overflows or costs a fortune. The truth is boring: keep the last few turns, summarize the rest, and only reach for semantic recall when you genuinely need to find an old needle. Tiers, sized to the budget. That's it. And no, a million-token context window is not a memory strategy — it's a bigger bill.

What's actually worth caring about: the loop, the two guards, errors-as-observations, the memory tiers, and the four failure modes. That's the whole phase, and it's enough to design and defend a real agent. What's not worth losing sleep over: which framework (they're all the same loop with different names), or chasing the fanciest planning pattern (ReAct is fine for most things; reach for ToT only when you actually have a search problem). Don't let LangChain-vs-LlamaIndex debates eat the time you should spend understanding the loop.

The career framing. "Agentic AI" is the headline of 2026, and it's going to be the headline for a while. Everyone wants to build agents; very few can reason about agents under failure. Be the second kind. The person who can stand at a whiteboard and say "here's the loop, here are the two guards, here's how a tool error becomes an observation, and here's how I keep it from getting prompt-injected into deleting prod" — that person owns the agent platform. The demo gets you the meeting; the failure-mode answer gets you the job. Now go make pytest green, and notice that the two soul tests — solves-the-task and stops-at-max-steps — are the whole job in miniature.