Model wars are becoming less interesting than the loops we build around them. Coding agents already write code, call tools, and inspect repositories. It all mostly works. The uncomfortable question is what we allow them to do while they perform this feat.

Most organizations put control at the end: review the pull request, approve the deployment, inspect the output. By then, an agent may have leaked a secret, changed production state, burned through the token budget, or called an API nobody intended to expose.

An agentic system contains five nested control loops: model, tool, environment, workflow, and organization. Every control has an enforcement point. We will map common failures to those points, then ask how the system contains damage and recovers.

Engineering leaders and platform teams can use this approach to find the gaps between their written policies and what their agent can actually do.