← Back to Autonomy

A Plain-Language Field Guide · Part 3 of 7

← Part II · Limits, Machines, and Problem-Solving

Logic and Reasoning

Part III · A Multi-Agent Problem-Solver

If the human mind solves problems with a loop of cooperating mental acts, what does an AI framework that copies that loop look like? Part three turns the reasoning of the series into a working design, animated as it solves a real problem.

Section 19

Why a society, not a single genius

To build software that solves problems the way people do, the worst move is to build one all-knowing agent. The better move is to build a small team where the idea-makers are kept separate from the fact-checkers.

Part II ended on a picture: the human mind solves problems by being both a fast, careless idea generator and a slow, careful checker, with something in the middle deciding what to trust. A good agent framework copies that shape directly. It does not try to make one model brilliant. It splits the work into roles and, above all, keeps the part that proposes answers apart from the part that verifies them. That separation is where almost all of the reliability comes from, for the same reason it helps in people: a mind grading its own homework tends to pass itself.

ONE AGENT, ALONE proposes an answer and checks itself confident, often wrong A SMALL TEAM proposer proposer VERIFIER checks, separately guesses are cheap, the check is trusted
Figure 16. The core design choice. One agent that proposes and checks itself inherits the failure it cannot see. A team that routes every proposal through a separate verifier catches what any single member would miss.
Practical note Start with three roles, not twelve: a proposer, a verifier, and a coordinator. Every role you add costs latency, tokens, and a new way for the agents to talk past each other. Grow the cast only when a specific weakness demands it.
Section 20

The cast of agents

Each mental act from the human loop becomes a role on the team. Here is the full cast, with its job in plain terms and the human faculty it stands in for.

None of these has to be a separate model. A role is a job with clear inputs and outputs, and several can share one underlying model with different instructions. What matters is that the jobs stay distinct. Tap each to see what it does.

Orchestrator

+

The team lead. Holds the goal, decides who acts next, spends a fixed budget of steps wisely, and notices when the team is stuck.

Human counterpart: metacognition, the part of you that watches your own thinking and steers it. It reasons about the work, not the problem.

Framer

+

Turns a vague request into a sharp one. Clarifies the goal, decides what kind of problem it is, picks how to represent it, and splits it into smaller pieces.

Human counterpart: representation. As Part II showed, choosing how to see a problem is often half the solution.

Retriever

+

Looks things up. Fetches relevant facts and past solved cases from the team's long-term memory, including ones that only match by deep structure.

Human counterpart: recall and analogy. It is how the team brings expertise to bear instead of starting from zero.

Proposers

+

The idea machines. Several run at once with different angles, throwing out candidate answers, plans, or guesses. They are meant to be fast and often wrong.

Human counterpart: abduction, the creative leap. Nothing they say is trusted until it is checked, so boldness is safe here.

Reasoner

+

Works out consequences. Takes a candidate and turns it into a concrete, testable prediction, often by calling a tool like a calculator, simulator, or code runner.

Human counterpart: deduction. It converts "maybe X" into "if X, then we should see Y."

Verifier and critic

+

The fact-checker, deliberately a different agent from the proposers. Runs the test, scores the evidence, and actively tries to break the candidate rather than wave it through.

Human counterpart: critical thinking. This is the slow, exact check that gives the whole system its trustworthiness.

Experimenter

+

Acts on the world when thinking is not enough. Runs a probe, queries data, or tries something in a safe sandbox, and decides when to keep exploring versus commit.

Human counterpart: experiment and the explore-exploit tradeoff from Part II.

Learner

+

Files away what worked. After a solve, it writes the pattern back into long-term memory, indexed by structure, and records lessons from failures.

Human counterpart: deliberate practice. It is how the team's expertise grows over time.

Section 21

How one turn works: the control loop

The agents do not run in a fixed line. They share one workspace, and a coordinator decides who goes next. The shape is exactly the human problem-solving loop from Part II.

Everyone reads and writes to a shared notepad called the blackboard. It holds the current goal, the live guesses, and the evidence gathered so far. It is the team's working memory, and like human working memory it is deliberately small and temporary. The orchestrator looks at the blackboard, picks the next agent to act, and that agent posts its result back. Round and round, each pass narrowing things down. A finding from one turn becomes a starting fact for the next.

ORCHESTRATOR picks next agent, spends the budget BLACKBOARD shared workspace: goal, guesses, evidence (the working memory) FRAMER represent RETRIEVER recall PROPOSERS abduction REASONER deduction VERIFIER critical check EXPERIMENTER explore MEMORY STORE long-term SANDBOX isolated HUMAN-IN-THE-LOOP GATE approves high-stakes actions
Figure 17. The framework, all at once. The orchestrator and the blackboard sit at the centre; every agent reads and writes the blackboard rather than messaging each other directly. Memory and the sandbox support specific agents, and a human gate stands between the team and any consequential action.

One more detail makes it behave like a real problem-solver: the blackboard holds beliefs loosely. If a later finding contradicts an earlier guess, that guess is simply withdrawn, with no crisis. This is the defeasible, non-monotonic reasoning from Part I, and it is what lets an agent change its mind gracefully when fresh evidence arrives. Step through a full turn below on a real-feeling problem.

Interactive · step the orchestrated loop
Press the button to start. Problem: the nightly data pipeline failed.
Blackboard · shared workspace
Section 22

Watch it solve a problem

Diagrams are clearer when they move. Below, the framework actually runs. Press play and watch control and data flow between the agents and the shared blackboard as the team solves one real problem from start to finish.

The problem is the same one from the last section: the nightly data pipeline failed. Each agent lights up when it acts. A pulse travels from the blackboard out to the agent when the orchestrator hands it control, and another travels back when the agent posts its result. Hypotheses appear, then turn green or red as the evidence comes in. The whole thing ends where it should, at a human gate.

Interactive · the agentic loop, animated
BLACKBOARD + orchestrator shared workspace FRAMERrepresent1RETRIEVERrecall2PROPOSERSabduction3REASONERdeduction4EXPERIMENTERexplore5VERIFIERcritical check6
Press play to watch the team solve the nightly-pipeline failure.
Blackboard · shared workspace
Figure 18. The loop in motion. Control and results flow through the central blackboard, the agents act in turn, and the dashed ring is the path the team would travel again if the evidence had not settled the question.

Notice three things as it plays. Everything passes through the blackboard rather than agent-to-agent, which keeps the team's shared picture in one place. The proposers throw out a weak guess (the clock-drift one) that costs nothing because the verifier simply drops it. And the loop solves it in a single pass only because one cheap test split the hypotheses cleanly. When a test is not decisive, the team rounds the ring again, which is what the dashed loop is there to show.

Practical note A view like this is not just for explaining. Logging each pulse and blackboard write gives you a replayable trace of exactly what the system believed and when, which is the single most useful thing to have when an agent run goes wrong and you need to find out why.
Section 23

How an agent actually thinks: reasoning strategies

The control loop says when the proposer thinks. It does not say how. A model that blurts its first answer reasons badly; a handful of strategies separate a guess from a worked solution.

They form a ladder of their own, from cheap and shallow to expensive and thorough. Pick one to see how it works and what it costs.

Interactive · reasoning strategies
chain sample + vote branch + prune value-guided more compute, more thorough
Figure 19. Four ways to spend more thinking on a harder problem, from one chain to a value-guided search. ReAct and Reflexion are a separate family that loops this reasoning together with action and feedback from the world.

The through-line: every strategy is a different way to spend more computation when a problem earns it, by writing the steps down, by sampling more of them, by searching among them, or by looping with feedback from the world. They all rest on the same Part II insight, a fast fallible proposer made reliable by structure and checking. Match the strategy to the stakes: a one-line lookup does not need a tree search, and a safety-critical isolation does not deserve a single guess.

Practical note Spend reasoning like money. Default to the cheapest strategy that clears the bar, and escalate to sampling or search only for the problems where a wrong answer is costly. The orchestrator deciding how hard to think is itself a value-of-information call.
Section 24

Memory: the notebook and the library

The team needs two kinds of memory, for the same reason you do: a small scratchpad for the problem in front of you, and a deep library of everything you have learned before.

The blackboard is the scratchpad. It is small on purpose, holding only what is relevant right now, and it is wiped when the job is done. Behind it sits the library: a large, lasting store of facts, skills, and past solved cases. When a new problem arrives, the retriever searches the library for anything that fits.

BLACKBOARD small, temporary "what we think now" LONG-TERM STORE knowledge graph + past solved cases indexed by deep structure retrieve a matching case write back what worked (the learner)
Figure 20. Two-tier memory. The blackboard is working memory; the long-term store is the team's growing expertise. The arrow back is what turns experience into skill.

The most important design choice here is how the library is organised. Part II noted that experts file problems by their deep structure, not their surface look. The store should do the same, so that a new billing bug can pull up an old inventory bug because both are really the same kind of race condition. Indexing only by surface words means the useful past case sits right there and is never found.

Practical note A knowledge graph plus vector search works well for this: the graph captures structured relationships between cases and concepts, and the vectors catch fuzzy similarity. Have the learner store each solve with a short summary of its structure, not just its raw text, and exposing the store through a tool interface keeps it cleanly separated from the agents that query it.

Not one memory, but several

Splitting memory into a scratchpad and a library is only the start. Cognitive science finds that people keep several distinct kinds of long-term memory, and a capable framework wants the same kinds, because they answer different questions. Tap each to see it.

Working memory

+

The blackboard. Small, fast, and wiped when the job ends. Holds only what the team is thinking about right now.

In the framework: the shared workspace, kept inside the model's context window.

Episodic memory

+

Specific past experiences. "Last Tuesday's run failed this way and here is what fixed it." Memories of particular events, with their context.

In the framework: the case library of past solved problems and full run traces.

Semantic memory

+

General facts and concepts, stripped of when you learned them. "Pipelines have an extract, transform, and load stage."

In the framework: the knowledge graph and domain references the retriever queries.

Procedural memory

+

Skills and how-to, the things you do without spelling them out. Riding a bike, or running a standard diagnostic.

In the framework: learned tools, reusable routines, and cached plans the agents can just call.

Parametric vs external knowledge

+

Knowledge baked into the model's weights (parametric) versus knowledge looked up from a store at the moment it is needed (external).

The design choice: bake in what is stable and universal, retrieve what is fresh, private, or specific. Retrieval is easier to update and to audit.

MEMORY SHORT-TERM the blackboard LONG-TERM the library EPISODIC past runs SEMANTIC facts, graph PROCEDURAL skills, tools stored in weights (parametric) or looked up (external)
Figure 21. The kinds of memory. The blackboard is short-term; the long-term library holds episodic, semantic, and procedural memory, each stored either in the model's weights or in an external store.
Practical note Keep these in separate stores with separate update rules. Episodic memories are append-only logs you rarely edit. Semantic facts get corrected and versioned. Procedural skills are tested before they are trusted. Mixing them into one undifferentiated "memory" blob is the fastest way to make retrieval noisy and updates dangerous.
Section 25

Where knowledge actually lives

Once a model is deployed, its weights are frozen. That single fact decides the whole memory design: any knowledge that is new, changing, private, or specific to the task at hand has to live somewhere other than the weights.

In practice there are four stores, and what separates them most is how often each one can be written. The frozen weights are the fixed foundation. The other three are where all the live, updatable knowledge sits.

SHORT-TERM MEMORY context window / blackboard · update: every step FROZEN WEIGHTS the pretrained model update: never (offline only) RAG STORE facts, docs, past cases update: continuous SKILLS & WORKFLOWS reusable tools, routines update: as learned retrieve call ANSWER / ACTION loop back learner writes adds skills
Figure 22. The four stores. The frozen model never changes at runtime. Short-term memory feeds it the task every step, the RAG store and the skills library feed in on demand, and results loop back into short-term memory while the learner writes lasting lessons out to the other two.
StoreWhat it holdsWrittenReadEditable live?
Frozen weightsGeneral language, broad world knowledge, baseline skillOnly in offline trainingEvery tokenNo
Short-term memoryThe current task: goal, dialogue so far, intermediate resultsConstantly, during the taskConstantlyYes, but volatile
RAG storeFacts, documents, past cases (semantic and episodic)Anytime, freelyWhen relevant to the queryYes
Skills & workflowsReusable tools and multi-step routines (procedural)As new procedures are learnedWhen a task needs themYes

Short-term memory is the one under the most pressure

Of the four, short-term memory is the easiest to overlook and the easiest to break. It is the running context the model sees on this step: the goal, what has happened so far, the latest retrieved facts, the partial answer. Everything the model "knows" in the moment that is not baked into its weights has to be loaded into this window. And the window is finite. So short-term memory is a budget, not a free space. When it fills, the system has to summarize and drop older detail to make room, which is exactly the forgetting work in the next section, applied first and most often right here. Manage it badly and the agent loses the thread mid-task; manage it well and a small window can carry a long, coherent piece of work.

Notice that these four are simply the concrete build of the memory types from two sections ago. Parametric knowledge is the frozen weights. Working memory is short-term memory. Semantic and episodic memory are the RAG store. Procedural memory is the skills-and-workflows library. The cognitive picture says what kinds of memory you need; this picture says where each one actually sits in a running system.

Practical note Because the weights are frozen, never rely on them for anything fresh, private, or fast-changing. Route changing facts to the RAG store, reusable procedures to the skills library, and the task itself to short-term memory. Each can be updated and inspected without retraining, which is most of why this split exists.
Practical note Treat the context window as a managed resource with its own policy: what gets loaded, in what order, and what gets summarized or evicted when space runs low. A retrieval step that dumps ten documents into short-term memory can crowd out the very task state the model needs to stay coherent.
Section 26

How the system learns

The learner does more than file notes. A framework can get better in several different ways, and they run on two very different clocks.

The fast clock turns during a single task: the system writes to its memory and reuses what it finds, without ever changing the model's weights. The slow clock turns across many tasks, offline, by actually retraining the model on what it has collected. Most of what people call "learning" in a live agent is the fast kind, and that is usually the right default because it is cheap, reversible, and easy to inspect. The slow kind is more powerful and more permanent, and more dangerous to get wrong.

Underneath, the classic learning regimes all have a place, distinguished by what signal they learn from.

Kind of learningSignal it usesWhat changesWhere it lives
In-contextWhatever is on the blackboard and in retrieved memoryNothing permanent; only the prompt and the stored casesRuntime, every task (the cheap default)
SupervisedLabeled examples, or its own past successful tracesModel weights, toward imitating good answersOffline, on collected data
ReinforcementA reward for the outcome, often from the verifierModel weights, toward higher-reward behaviourOffline, using the verifier as the reward source
Unsupervised / self-supervisedStructure in unlabeled data, no answers givenRepresentations; discovered skills and groupingsOffline; also builds the structure-index for retrieval
FAST CLOCK in-context, at runtime store and reuse, no weights change SLOW CLOCK · offline weight updates SUPERVISED · imitate good answers REINFORCEMENT · reward from verifier UNSUPERVISED · find structure traces feed training runtime learning is cheap and reversible; weight updates are powerful and permanent
Figure 23. Two clocks of learning. The fast clock changes only memory and the prompt during a task. The slow clock changes the model itself, offline, and the verifier from Part II is what supplies the reinforcement reward.
Practical note Reach for the cheapest learning that works. Try in-context and memory first, since it is reversible and you can read exactly what changed. Only bake a pattern into the weights once it is stable and common enough to be worth the cost. And remember the recurring rule: reinforcement learning is only as trustworthy as the verifier giving the reward.
Section 27

Learned tools: turning data into callable knowledge

A tool or skill does not have to be a script. It can be a trained network that holds knowledge no one could write down by hand, and the learning method you choose decides what form that knowledge takes and what the tool is good for.

The skills store from earlier is more varied than a folder of code. Some entries are symbolic scripts, exact and verifiable, for procedures that are fully known. The rest are learned networks, for everything that is only known from data. The useful way to see it is that each learning method from the last section crystallizes one of the reasoning modes from Part II into a frozen, callable artifact.

Supervised learning makes predictive tools: it captures an input-to-output mapping, so the artifact answers "what will happen." In a vehicle-health setting these are forward dynamics models learned from logged trajectories, fast surrogates that stand in for an expensive physics simulation, remaining-useful-life regressors, and fault classifiers. Unsupervised and self-supervised learning make structural tools: with no labels, they capture the shape of the data, giving you the embeddings behind the retrieval index, anomaly and out-of-distribution detectors, and latent dynamics in the Koopman spirit, where a learned change of coordinates makes the dynamics nearly linear and hands you back something a controller can use. Reinforcement learning makes strategic tools, and that is the interesting case.

MethodForm of knowledgeTool it makesExampleUsed by
SupervisedPredictive (induction)Dynamics model, surrogate, RUL regressor, classifierForecast winding temperature from logsThe reasoner, for model-based rollouts
UnsupervisedStructural (abstraction)Embeddings, anomaly / OOD detector, latent dynamicsFlag an operating point as novelThe gate, and the retrieval index
ReinforcementStrategic (experimentation)Policy, value function, reward model, model-based controllerLearn which test isolates a fault fastestThe actor; value guides the search

Why reinforcement learning is the one to dwell on

Supervised learning needs someone to have known the right answer and labeled it. Reinforcement learning needs only a reward, so it can acquire competence that nobody can demonstrate: a control law that exploits the dynamics in a way hand-tuned gains never find, or a behavior in a regime where the best action is not available in closed form. The form of knowledge it captures is neither declarative nor merely predictive. It is procedural and goal-relative, closed-loop know-how with credit assigned across a horizon. And it does not yield one artifact but several, each a different tool.

A policy is a learned skill, the network acting as a controller, for maneuvers too high-dimensional or nonlinear to script. A value function is a learned evaluator, an amortized answer to "how promising is this option," and it is quietly the most useful artifact for the agent itself, because it is a trainable version of the search heuristic from Part II and can rank hypotheses or steer a search the way a value network steers tree search. A reward model is a learned critic of quality where correctness is fuzzy. And model-based reinforcement learning ties the stack together: learn the dynamics, then plan or train a policy by rolling out through that model.

The cleanest example for this framework: deciding which cheap test to run next to isolate a fault fastest is a sequential decision under uncertainty with an obvious reward, information gained per cost. That is exactly the experimenter's job from the animated walkthrough, and it can be learned as an RL policy. The agent's exploration stops being a hand-written rule and becomes a trained skill. Reinforcement learning is, in effect, the explore step of the problem-solving loop compiled into a callable.

RAW LOGS trajectories REPRESENTATION latent state DYNAMICS MODEL a predictor POLICY + VALUE a controller self-supervised supervised RL in sandbox ANOMALY DETECTOR normal vs novel reward checked by verifier SKILLS & WORKFLOWS STORE every learned artifact becomes a callable tool, beside the scripts
Figure 24. Manufacturing tools from data. Self-supervised learning yields a representation and a normality detector, supervised learning fits the dynamics, and reinforcement learning trains a policy and value by planning through that model inside the sandbox. All of them land in the skills store as callable tools, next to the scripts.

Picking the right tool

The reasoner does not need a learned network for everything. It routes by the nature of the subproblem. Try it: pick what you are facing, and see which kind of tool fits.

Interactive · the tool router

A learned tool is a fallible proposer, not an oracle

This is the rule that keeps learned tools safe inside the framework. A trained network is exactly the fast, confident, sometimes-wrong proposer the whole series has warned about, so it is treated the same way. Every learned tool ships with calibrated uncertainty, from an ensemble or a Bayesian head, and an out-of-distribution check. When the anomaly detector says the situation has left the region the tool was trained on, the agent retracts its trust in that tool and falls back to deliberate reasoning or a human. That is the defeasible behavior from Part I applied to a learned component. Its output still passes the verifier like any other proposal. And reinforcement learning carries its own version of confirmation bias, called reward hacking, where the policy games a flawed reward, which is caught the same way the bias-monitors catch the others: by trying to break the reward, not just satisfy it.

The unifying thought Supervised, unsupervised, and reinforcement learning are the offline crystallizations of the reasoning modes from Part II: induction frozen into a predictor, abstraction frozen into a representation, and experimentation frozen into a policy. A learned tool is a reasoning mode compiled into weights and frozen into something the agent can call. Underneath, the split is simple: a tool captures models and dynamics to inform deliberation, while a skill executes an action. Reinforcement learning is the one method that makes both, because a value function is a tool and a policy is a skill, learned from the same experience.
Practical note Where you can, prefer a learned dynamics model paired with a classical controller over an end-to-end policy. It is far more verifiable, since you can inspect and test the predictor separately from the decision rule. Train reinforcement learning in the simulation sandbox, never on the live system, and remember the recurring rule: the policy is only as good as the reward the verifier can vouch for.
Practical note Treat every learned tool like a dependency with a version, a confidence estimate, and a monitor. Log its predictions against what actually happened, watch for drift as the operating distribution shifts, and feed that back into the forgetting-and-relearning loop so a stale model is retired or retrained before it quietly starts being wrong.
Section 28

What it must forget

A memory that only ever grows becomes slow, stale, and unsafe. Forgetting is not a bug to be fixed. It is a feature that keeps memory useful, and people rely on it just as much.

Left unchecked, a store fills with duplicates, outdated facts, dead ends, and things that should never have been kept. Retrieval gets noisier, costs climb, and the system starts acting on beliefs that are no longer true. So a real framework needs deliberate ways to let go. Tap each.

Evict and summarize

+

When the blackboard overflows the context window, old detail is compressed into a short summary and the raw text is dropped.

Why: working memory is bounded, exactly like ours. Summarizing keeps the gist while freeing room.

Decay by age and use

+

Entries that are old and rarely retrieved lose priority and eventually drop out of easy reach.

Why: what you have not needed in a long time is usually safe to let fade, which is how human forgetting works too.

Invalidate on contradiction

+

When new evidence contradicts a stored fact, the old fact is retracted rather than kept alongside the new one.

Why: this is the defeasible belief revision from Part I. Holding both makes the system incoherent.

Consolidate and dedupe

+

Many near-identical cases are merged into one cleaner, more general pattern.

Why: it mirrors how sleep is thought to compress memories, and it keeps the library sharp instead of bloated.

Prune low value

+

Cases that never help on later problems are scored down and removed.

Why: a store should keep what earns its place, not everything that ever happened.

Deliberate deletion

+

Some things must be removed on purpose: private data, a right-to-be-forgotten request, or a poisoned or wrong memory.

Why: this is easy in an external store and genuinely hard once knowledge is baked into weights, where it becomes machine unlearning.

MEMORY keeps growing summarize decay invalidate prune USEFUL stays sharp forgetting is what keeps the rest worth remembering
Figure 25. The forgetting pipeline. Growing memory is continuously filtered so that what remains stays small, current, and trustworthy.
Practical note Give every long-term entry a source, a timestamp, and a usefulness score, and make forgetting a logged, reviewable action rather than a silent one. Beware catastrophic forgetting in the slow clock: fine-tuning on new tasks can quietly erase old skills, so test for what the model used to be able to do, not only for the new thing.
Section 29

The supervisor and the bias-catchers

What makes the framework feel human is not the agents but the supervisor over them, and a set of small watchdogs whose only job is to catch the classic ways problem-solving goes wrong.

The orchestrator does two human things. First, it spends a budget. Just as you decide where to put your limited attention, it decides how many tool calls and how much compute each part of the problem deserves, and stops chasing a dead end. Second, it watches for trouble. The failure modes from Part II are predictable, which means they can be detected, so the best move is to build a small monitor for each one.

A fixation monitor notices the same failing approach being retried and forces a switch. A premature-closure monitor refuses to let the team commit until at least one rival idea has been weighed. A confirmation monitor makes the experimenter run a test that could disprove the favourite, not just confirm it. A local-optimum monitor spots the team polishing a mediocre answer and triggers a fresh start from a new angle. These watchdogs are cheap and they prevent the most common and most expensive mistakes. Try switching one on and off below.

Interactive · the value of a bias-catcher

The team has a favourite explanation that fits the evidence. Should it ship the fix, or first try to prove itself wrong? Toggle the monitor, then run.

Falsification monitor: ON
Practical note Treat the monitors as first-class parts of the system, not afterthoughts. The cheapest large gain in reliability is usually a rule that says "before committing, generate one rival hypothesis and one test that would kill the current one." It directly counters the bias that costs teams the most.
Section 30

Guardrails: a human and a sandbox

A system that can act in the world needs two safety pieces that have nothing to do with intelligence and everything to do with not causing harm: a person at the important door, and a safe room for experiments.

The first guardrail is a human-in-the-loop gate. Before the team does anything costly or hard to undo, and before the final answer ships, a person approves it. This is the same idea as the trusted checker from Part II, now with a human as the last verifier: let the agents propose freely, but put a gate in front of consequences. Reversible, low-stakes steps can flow without it; the gate is reserved for the moves that matter.

The second guardrail is the sandbox. When the experimenter runs code or probes a system, it does so in an isolated environment that cannot touch anything important. The key rule is that the thing controlling the sandbox sits outside it. An agent must never be able to reach out and modify the cage it is running in, or the cage is not a cage.

agents VERIFIER HUMAN GATE approve / reject REAL ACTION SANDBOX (isolated) experiment control sits OUTSIDE the sandbox
Figure 26. Two guardrails. A human approves consequential actions after the verifier, and experiments run inside an isolated sandbox whose controls live outside it.
Practical note Decide in advance which actions are irreversible (sending money, writing to production, emailing a customer) and gate exactly those. Log every blackboard state so a failed run can be replayed and understood. And never let the agent hold the keys to its own sandbox.

Sandboxes come in strengths

There is no single sandbox, but a spectrum. Stronger isolation costs speed, so you match the level to how much you trust the code being run. A trusted snippet you wrote needs far less caging than code an agent generated on the fly.

RestrictedPython (in-process)

+

Runs a cut-down, safe subset of the language inside your own process. Lightest and fastest, weakest isolation.

Use when: the code is largely trusted and you only need to block a few dangerous operations.

Pyodide / WebAssembly

+

Runs code inside a WebAssembly box with no direct access to the host. Moderate isolation, still quite fast.

Use when: you want a clean, portable boundary without standing up a full machine.

Container with gVisor

+

An operating-system-level container hardened with a syscall filter that sits between the code and the real kernel. Strong, and the common choice.

Use when: running untrusted, agent-generated code at scale.

microVM (Firecracker)

+

A tiny, fast-booting virtual machine giving near-hardware isolation. Strongest, heaviest.

Use when: the code is fully untrusted or possibly hostile, and a breakout would be serious.

Simulation sandbox

+

A different idea: instead of isolating code, give the experimenter a model of the world (a physics simulator, or a staging copy of the system) to act in.

Use when: real-world experiments are slow, costly, or irreversible. Test on the copy, not the original.

RestrictedPython in-process Pyodide / WASM sandboxed runtime Container + gVisor OS-level microVM Firecracker faster, lighter stronger isolation match the strength to how little you trust the code
Figure 27. The isolation spectrum. Lighter sandboxes are faster but weaker; heavier ones are slower but safer. The harness that controls any of them must sit outside it.
Section 31

Where the analogy leaks

The human comparison is a guide, not a law. Three places where it breaks down matter a great deal when you actually build one of these.

First, the "fast" agents are not fast. In a person, the quick intuitive guess is nearly free. In this framework, every agent is a slow, expensive model call, so a design with many roles can be far slower and costlier than a single well-instructed agent. The mind's cheap-proposal, expensive-check asymmetry is something you have to engineer toward, not something you get for free.

Second, more agents is not more intelligence. Each new role adds coordination overhead and new ways for the team to misunderstand each other. A tight team of three often beats a sprawling team of twelve. Add a role only when you can name the specific failure it fixes.

Third, and most important, the whole thing is only as good as its verifier. The reliability story rests entirely on having a way to check answers against ground truth: a test suite, a simulator, a formal checker, the real environment. Where that exists, this architecture is genuinely powerful. Where checking is itself fuzzy and subjective, the propose-and-verify backbone weakens, and you are back to trusting fluent text, which is the exact trap the whole series has warned about.

The closing thought A multi-agent problem-solver is the human loop, built on purpose and in the open. Logic sets the standard, the reasoning modes supply the moves, memory supplies the shortcuts, the verifier supplies the trust, and a supervisor with a human at its side decides what to believe and what to do. Build the separations deliberately, respect the limits honestly, and you get a system that solves problems much the way we do, including, when you are not careful, the ways we get them wrong.

Practical note Before committing to a multi-agent design, measure it against one strong single agent on your real task. Keep the extra structure only where it earns its cost in accuracy, safety, or transparency. Comprehension and reliability, not agent count, are the goal.
Appendix

References and further reading

This part builds on the foundations in Parts I and II. The works below cover the agent and cognitive architectures behind the design.

  1. Minsky, M. (1986). The Society of Mind. Simon & Schuster. The conceptual ancestor of mind-as-many-agents.
  2. Erman, L. D. et al. (1980). The Hearsay-II speech-understanding system. ACM Computing Surveys, 12(2). The original blackboard architecture.
  3. Newell, A. (1990). Unified Theories of Cognition. Harvard University Press. The Soar cognitive architecture.
  4. Anderson, J. R. et al. (2004). An integrated theory of the mind. Psychological Review, 111(4). The ACT-R architecture.
  5. Wooldridge, M. (2009). An Introduction to MultiAgent Systems (2nd ed.). Wiley.
  6. Yao, S. et al. (2023). ReAct: synergizing reasoning and acting in language models. ICLR.
  7. Shinn, N. et al. (2023). Reflexion: language agents with verbal reinforcement learning. NeurIPS.
  8. Yao, S. et al. (2023). Tree of Thoughts: deliberate problem solving with large language models. NeurIPS.
  9. Wang, G. et al. (2023). Voyager: an open-ended embodied agent with large language models. arXiv:2305.16291.
  10. Park, J. S. et al. (2023). Generative agents: interactive simulacra of human behavior. UIST.
  11. Wu, Q. et al. (2023). AutoGen: enabling next-gen LLM applications via multi-agent conversation. arXiv:2308.08155.
  12. Hong, S. et al. (2023). MetaGPT: meta programming for a multi-agent collaborative framework. arXiv:2308.00352.
  13. Schick, T. et al. (2023). Toolformer: language models can teach themselves to use tools. NeurIPS.
  14. Karpas, E. et al. (2022). MRKL systems: a modular, neuro-symbolic architecture. arXiv:2205.00445.
  15. Atkinson, R. C. & Shiffrin, R. M. (1968). Human memory: a proposed system and its control processes. The short-term and long-term store model.
  16. Tulving, E. (1972). Episodic and semantic memory. In Organization of Memory. The classic distinction.
  17. Squire, L. R. (2004). Memory systems of the brain. Neurobiology of Learning and Memory, 82(3). Declarative versus procedural memory.
  18. McCloskey, M. & Cohen, N. J. (1989). Catastrophic interference in connectionist networks. Psychology of Learning and Motivation, 24.
  19. Lewis, P. et al. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. NeurIPS. Parametric versus non-parametric memory.
  20. Christiano, P. et al. (2017). Deep reinforcement learning from human preferences. NeurIPS.
  21. Ouyang, L. et al. (2022). Training language models to follow instructions with human feedback. NeurIPS. Supervised fine-tuning and RLHF.
  22. Sutton, R. S. & Barto, A. G. (2018). Reinforcement Learning: An Introduction (2nd ed.). MIT Press.
  23. Bourtoule, L. et al. (2021). Machine unlearning. IEEE S&P. Deliberately removing learned data.
  24. Sumers, T. et al. (2023). Cognitive architectures for language agents (CoALA). arXiv:2309.02427. A framework for working, episodic, semantic, and procedural agent memory.
  25. Packer, C. et al. (2023). MemGPT: towards LLMs as operating systems. arXiv:2310.08560. Managing a finite context window against external long-term memory.
  26. Silver, D. et al. (2017). Mastering the game of Go without human knowledge. Nature, 550. A value network guiding search.
  27. Schrittwieser, J. et al. (2020). Mastering Atari, Go, chess and shogi by planning with a learned model (MuZero). Nature, 588.
  28. Ha, D. & Schmidhuber, J. (2018). World models. arXiv:1803.10122. Learning a dynamics model to train a controller inside it.
  29. Brunton, S. L. & Kutz, J. N. (2019). Data-Driven Science and Engineering. Cambridge University Press. Data-driven dynamics, Koopman, and SINDy.
  30. Chua, K. et al. (2018). Deep reinforcement learning in a handful of trials using probabilistic dynamics models. NeurIPS. Uncertainty-aware model-based RL.
  31. Amodei, D. et al. (2016). Concrete problems in AI safety. arXiv:1606.06565. Reward hacking and related failure modes.
Continue · Part 4 of 7From a Mind to a Society of Minds →Coordination, debate, markets, and the failures that only a group of agents can have.← Back to Part 2Limits, Machines, and Problem-SolvingPart II of the series.