An agent needs a control loop, not a vague goal

In a multi-agent design, the orchestrator owns the goal. Its job is to decide how the work is divided, issue the assignments, and make sense of the results together. A subagent owns one scoped piece of work and returns its finding. This separation is useful only if the orchestrator has made the handoff clear enough to inspect. “Review this material” is a vague instruction; a named unit, expected output, and known completion condition are a workable assignment.

Before dispatching, decide what a usable return looks like. The expected structure might require a finding, the evidence considered, and a stated uncertainty. It might also require the subagent to say that it could not complete the unit. The exact format will depend on the task. What matters is that the coordinator can distinguish a valid result from an empty response that merely looks like one.

There is a second design choice here: how the coordinator will handle disagreement and gaps. Two subagents can return incompatible findings. A result can be present yet fail the expected structure. The system should not leave either case to an improvised final summary. Define the conflict rule or escalation route while the architecture is being designed, when it can still be examined by the people accountable for the outcome.

A fluent synthesis is not proof that all of the underlying work happened. Consider a hypothetical illustration: a coordinator divides a policy review into independent sections. Most subagents return usable findings, one times out, and another returns a response that cannot be parsed. If the coordinator produces a polished summary from the results in hand, a reader may receive an apparently complete answer with two silent holes in it.

The essential check is simple: reconcile the units returned with the units dispatched. The system must know how many pieces of work it asked for, which ones completed, which ones are still pending, and which ones were explicitly abandoned or escalated. A synthesis may only describe coverage that its own record can support. If the counts do not reconcile, the gap belongs in the output or in an exception queue before anyone treats the work as complete.

That record also needs to survive the journey across agents. A shared trace identifier lets an operator follow one run from the initial goal, through its subagent assignments, to its recoveries and final synthesis. Without it, each component can appear healthy in isolation while the complete trajectory is impossible to reconstruct. Observability is not an after-the-fact dashboard; it is the thread that makes a distributed decision reviewable.

Not all failures carry the same consequence. A subagent that returns nothing is often recoverable: validate the response, try again, route the unit to another capable path, or mark the unit as a gap. The key is that a recoverable failure still needs a mechanism watching for it. A timeout does not become safe merely because another part of the system continued running.

The coordinator's failure is different. If it loses the goal, the map of assignments, or the state it needs to synthesize results, there may be no trustworthy way to infer what happened after the fact. Protect that state and checkpoint progress so a failed run can resume from a known point rather than quietly rebuilding a different interpretation. This is not redundant ceremony. The orchestrator is the component holding the meaning of “complete.”

There is no virtue in pretending every interruption can be automated away. A sound design separates the conditions it can repair from the conditions it must surface. It then preserves enough evidence for an operator to decide whether to retry, resume, change the assignment, or stop the run. That is what makes an agent's autonomy bounded in practice rather than only in a diagram.

Human review is not a single setting that is either on or off. In an agent workflow, it is a gate placed before the action whose risk or irreversibility requires accountable judgment. The gate pauses the run so a person can review the proposed action, the information that led to it, and any exception recorded in the control loop.

That does not mean a person needs to inspect every low-stakes step. Routine, reversible actions can be sampled rather than held behind a universal approval queue. The architectural point is proportionality: reserve the pause for the point at which a bad autonomous action would be difficult to undo or would carry material consequences. The system can still move quickly where the consequence is low, while keeping responsibility visible where it matters.

Checkpoint placement also changes the quality of the handoff. A reviewer should receive more than a recommendation in isolation. The run should make available the goal, the actions taken, the coverage status, the remaining gaps, and the trace that connects them. A person cannot meaningfully approve an action if the system hides the evidence needed to understand what it is asking them to approve.

Before asking an agent to coordinate work across several actions or subagents, ask:

1. Who owns the goal, the decomposition, and the final synthesis?
2. What exactly is dispatched, and what result structure must return for each unit to count as complete?
3. How will the system reconcile requested units, valid returns, pending work, failures, and declared gaps?
4. Which failures can be retried or re-routed, and which must be surfaced to an accountable person?
5. What state must be checkpointed so a failed coordinator can resume rather than restart ambiguously?
6. Can one trace connect the goal, delegated work, recoveries, and final outcome?
7. Which proposed action needs a human gate because it is high-stakes or difficult to reverse?

A useful agent does not merely pursue a goal. It keeps the operation oriented while the route changes: observe the state, compare it with the expected coverage, correct recoverable failures, and stop for human judgment where the decision deserves it. That is the difference between a promising autonomous demonstration and a system an organisation can responsibly operate.