A system with tools and a bounded agent loop can run a workflow: plan → call tool → observe → iterate. This chapter is the runtime contract between stochastic generation and deterministic infrastructure - everything upstream of aliases (Appendix F.1) and verify (Appendix F.3). This is the architecture of modern AI agents. 1. Receive a goal from the user (e.g., "summarise today's earnings releases"). 2. Plan. The agent breaks the goal into sub-tasks (fetch the list of earnings releases, fetch each release, summarise each). 3. Act. For each sub-task, the agent either calls a tool (an external API, a database query, a calculation) or generates output. 4. Observe. The agent reads the tool's response and decides what to do next. 5. Iterate. Steps 3-4 repeat until the goal is complete or the agent gives up.
Figure 1. Concept map for this episode: fight, desk translation, what to lock.
The agent loop
1. Receive a goal from the user (e.g., "summarise today's earnings releases"). 2. Plan. The agent breaks the goal into sub-tasks (fetch the list of earnings releases, fetch each release, summarise each). 3. Act. For each sub-task, the agent either calls a tool (an external API, a database query, a calculation) or generates output. 4. Observe. The agent reads the tool's response. 5. Iterate. Steps 3-4 repeat until the goal is complete or the agent gives up.
The danger of over-orchestration
A natural temptation in agent design is to spawn many specialised sub-agents for every task - a "research agent," an "analyst agent," a "validator agent," etc. The danger is that each layer of agent indirection adds latency and failure modes. A 10-agent pipeline produces 10 places where a single hallucination or schema error can break the entire workflow. The professional consensus, as of 2026, is that simpler is usually better: one agent per workflow with access to all relevant tools, hard schema validation at every tool boundary (reject malformed JSON before it reaches the next stage), idempotent tools that can be safely retried, and bounded loops with a maximum number of tool calls per workflow to force a final answer. The architecture that maximises reliability is not the one that maximises theoretical capability - a robust single-agent system outperforms a fragile multi-agent system in every real production environment.
Context injection: what the model must know before it acts
Language models do not know the current date, market session, or caller identity unless you tell them. Context injection is the discipline of prepending cheap, certain facts to the system prompt so the model does not waste tool rounds - or worse, narrate stale truth as current. Temporal context (mandatory). Always inject date and time - one line such as "Current date and time (treat as now): Sunday, June 14, 2026, 09:00 UTC." Without it, the model behaves as if still at training cutoff; "latest news" answers become catastrophic for trading.
Retry with backoff: the only honest answer to a transient 503
Even a perfectly architected agent will, from time to time, receive a transient failure from its underlying model server - a connection refused while a runner restarts, a queue overflow during a cron spike, a 503 emitted by a wedged process. The standard discipline is a small, capped retry loop with exponential backoff.
Definition
An adversarial counterfactual prompt is a generation prompt mechanically derived from a paired-evidence source prompt by extracting one side of the pair and requesting a response that argues the opposite side using the strongest available evidence. The prompt is generated by deterministic transformation, never by the model under training, to avoid amplifying the bias the prompts are meant to correct.
Worked picture
Without temporal context, an LLM asked "what is the latest news on TICKER X?" will often respond with information from its training cutoff (perhaps a year old). For a trading application, this is catastrophic - the model is generating "stale truth" while presenting it as current. With temporal context injected: the model knows it does not have current information, will say so explicitly, and will (correctly) refuse to provide "latest news" without an external tool call to a live data source. The model becomes honest about its information horizon - which is what you want. The fix is trivial: prepend one line to every system prompt. The improvement in reliability is large. This is one of those rare engineering wins that costs nothing and prevents real money loss.
What breaks in production
A common architectural mistake: spin up agents named "Bull Analyst," "Bear Analyst," "Risk Analyst," and "Decider" - let them debate, then have the Decider pick a final answer. It feels sophisticated. In practice, this architecture is worse than a single agent with access to all the same tools, for three reasons: 1. Compounded hallucination. Each agent has its own hallucination rate. Four agents in series compound to 4× the failure rate. 2. Latency multiplication. Four agent calls take four times as long as one - and each call costs money. 3. No real intelligence. The "debate" is theatre. The Decider's reasoning is no better than a single agent reasoning about the same inputs. The fix is unromantic but effective: use one well-prompted agent with access to all the tools, and trust the model to consider multiple perspectives in its single reasoning chain. The "council" is a metaphor that does not deliver real value over a well-designed monolithic agent.
Key idea
LLMs in finance are useful but not magic. Their value comes from doing things that traditional code cannot: reading unstructured text, summarising news, classifying sentiment, generating rationales. Their danger is hallucination, stale knowledge, and the temptation to give them too much autonomy. The disciplines that make LLMs safe in production are unromantic: strict licensing audits, parameter-efficient adaptation with quality reward functions, sampling configurations that clip the long tail, single-agent architectures, capped retry loops with exponential backoff, mandatory temporal context, deterministic adversarial-counterfactual generation to correct corpus bias, and validation that treats every LLM output as untrusted until proven otherwise. Boring discipline beats clever architecture every time.