Where each part lives

Before building the loop, place its parts on the right side of the boundary.

The model receives context and produces either an answer or a structured tool request. It has learned patterns for choosing useful next steps, but it has no operating-system permission by itself.

The application assembles context, checks the request, enforces permissions, runs the loop, records results, and decides when human approval is required.

The tool performs one defined operation, such as searching, calculating, or writing a file. It should return a result the application can inspect and pass back.

The agent is the whole running arrangement. Calling the model alone an agent hides the controls that make action possible and safe.

Picture a restaurant. The model writes an order slip. The application is the waiter who checks it and carries it. The tool is the kitchen that does the work. A slip cannot cook by itself.

This separation tells you where to put safeguards. Do not merely ask the model to be careful. Make the application reject invalid requests and keep dangerous tools behind approval.