Agent in Practice
Foolproof Design: How to Make the Loop Stop Itself
Now that we know how Agents can get stuck, the next step is to design safeguards. Good foolproofing is a three-layer net that keeps the system from losing control without giving up too easily.
Three categories of protection strategies
Hard Limits
Unconditional brakes that trigger regardless of the situation
Iteration Cap
Set a maximum number of loops (e.g., 50 rounds) and force a stop when reached. Simple and blunt, but effective — the last line of defense.
Expand
Total Timeout
Set a maximum task execution time (e.g., 3 minutes). No matter how many rounds have run, interrupt on timeout to prevent indefinite resource usage.
Expand
Per-Tool Call Limit
Cap calls to any single tool at N times (e.g., max 5 calls per endpoint). Prevents the Agent from becoming fixated on one tool.
Expand
Detection
Monitor runtime state and raise alerts when abnormal patterns are detected
Identical-Parameter Detection
Check whether the same tool is called N consecutive times with identical parameters. If so, the Agent is spinning its wheels.
Expand
Same-Tool Detection
Check whether only one tool has been called in the last N rounds. If so, the Agent may be fixated — guide it to try a different approach.
Expand
Diminishing Returns Detection
Compare the output increment across recent rounds. If 10 rounds have run but fewer than 50 new words have been produced, classify as inefficient spinning.
Expand
Degradation
Continue in a degraded state or gracefully exit rather than stopping abruptly
Inject Correction Prompt
Inject a system message into the context: "You have repeated this 3 times — please try a different approach." Let the model adjust its own strategy.
Expand
Disable Failing Tool
When a tool fails consecutively, temporarily remove it from the available list. This forces the Agent to find an alternative path to complete the task.
Expand
Force Progress Summary
When a trigger condition is met, force the Agent to summarize what it has done and what results it has obtained, then return to the user with incomplete but partial progress.
Expand
The hierarchy of the three protection layers
Foolproofing is not a wall — it's a three-layer net
Degradation — Gracefully continue, complete the task as much as possible
Anomaly detected → Attempt self-correction
Detection — Detect early, warn in advance
Monitor patterns → Trigger degradation
Hard Limits — Last resort backstop, absolutely no runaway
Unconditional brake → Guarantee safety
Design principle: First let degradation attempt self-correction → if self-correction fails, detection escalates → hard limits serve as the final backstop.
In most cases, the Agent should be gently corrected; a hard kill is the last resort. For users, returning with partial results is far better than returning empty-handed.
In most cases, the Agent should be gently corrected; a hard kill is the last resort. For users, returning with partial results is far better than returning empty-handed.
Foolproofing is not a wall — it's a three-layer net: hard limits as backstop, detection for early warning, and degradation to keep going. Good protection design keeps the Agent from losing control without giving up too easily, returning with results whenever possible.