A demo agent loop runs until the model says it is done. A production loop cannot work that way. Each tool call is a request to change something, and your code, not the model, decides when the loop stops.
Claude returns a structured tool-use block: a tool name and arguments. Before anything runs, the application checks five things:
Valid JSON that asks for an invalid action is still invalid. The schema checks shape; business validation checks meaning.
Send back a typed success or error, with fields the model can use safely. Separate two kinds of error:
AMOUNT_MISMATCH with the recorded amount. Claude may repair the request once.
A loop that returns free-text errors invites blind retries and invented fixes.
Write these in code:
The simplest control is the tool you never give the agent. An accounts-payable agent that may request invoice approval does not need a payment tool. If payment is not on the allowlist, no prompt can make the loop release one.
Record the model version, inputs, tool calls, results and approvals for each run. When someone asks why the agent did something, the trace is the answer.