Misconceptions
The things rookies believe about agents that are not true. Yours first.
"Tools are called by the model."
The model has no hands. It writes a small JSON block: tool name plus arguments. That block is a request. Your runtime reads it and runs the function. Everything the model "does" is the runtime doing it on the model's behalf, which is also why a permission gate can sit in between.
"You have to call the model to run a tool."
No. Tools are functions. The runtime can run them whenever it wants: before the first model call (prefetch, building the packet), between passes, or with no model at all. Your own house does this: the packet builder queries the database in code and hands the finished packet to the agent. That is tools running with zero model calls. If a whole job runs on tools with no model, it is a script, not an agent.
"One prompt is one model call."
A run is usually several calls, one per pass, and every pass re-sends the whole context. Cost grows with passes times context size, which is why prompt caching and the breaker exist.
"The model remembers the last pass."
It remembers nothing. Context is rebuilt every pass and the previous turns are re-sent inside it. "Memory" is a store your runtime writes at Commit and reads at Context.
"Function calling means it's an agent."
One model call that returns a tool request, which you execute and stop, is function calling. An agent is when the result goes back into context and the model gets to go again. The loop is the difference.
"The agent is the model."
The model is step 04. The agent is the model plus the loop, the tools, the identity (system prompt), the trigger and the state. Swap the model and it is the same agent. Swap the tools and it is a different one.
"An error breaks the loop."
A tool error is returned to the model as text, flagged as an error. The model reads it and tries something else on the next pass. Only the breaker or the runtime crashing actually stops the loop.
"The model decides when to stop."
Half true. The model signals end_turn, but the breaker can stop it earlier, Validate can bounce it back for another pass, and a human gate can deny a leg. The runtime owns stopping.
"Thinking, streaming and RAG are steps in the loop."
Extended thinking happens inside step 04. Streaming is how step 04's reply is delivered. RAG is one way of doing step 02. None of them change the shape of the loop.
"Parallel tools mean parallel agents."
One reply can carry several tool requests; the runtime runs them side by side and waits for all of them. That is one agent, one pass, several legs. Parallel agents is a different pattern (see Variations).