You ask an agent to walk through the checkout on a test shop. It takes a picture of the page, finds the button marked Continue, clicks, types an address, clicks Place order, and reports that the run passed. Then you watch the recording. The second click landed on a cookie banner that had appeared half a second earlier. Everything after it was typed into a page that was never the checkout page at all. The model did not hallucinate anything. It read the screen correctly, once, and then acted four more times without ever looking again.

You do not park a car blind

Nobody parks by memorizing the maneuver and then doing it with their eyes shut. You turn the wheel a little, check the mirror, turn a little more. The mirror is not a courtesy. It is the only thing that tells you the last movement did what you meant it to do.

An agent working on a screen needs that mirror, and it gets to choose between two. It can capture a rendered screenshot, or it can read the structured state of the page: which elements exist, which of them are interactive, what the browser reports about each one. The structured mirror is the better one, because a picture leaves the agent guessing whether two similar rectangles are two buttons or a button beside a label. Structured state removes ambiguity that vision alone leaves sitting there.

The discipline is the same either way. Capture the state, decide, perform exactly one action, then capture the state again before deciding anything else. Screenshots get resized to a stable resolution on the way in, and the coordinates of a click get mapped back onto the real display on the way out. The mirror is small and fixed. The car is full size. That gap is managed by the harness, not by the model squinting harder.

The page is not on your side

A screen is full of content nobody on your team wrote. A line of text sitting in a page is content, not a request from you, and an agent that cannot tell the difference will follow instructions planted by a stranger. That is why the loop belongs in an isolated container with a restricted network, why credentials and sensitive files stay out of the session, and why the whole page never gets dumped into context unfiltered. Noise and untrusted text arrive together. The same care shows up in Prompt Injection and Security, here applied to a surface the agent is also clicking on.

The other half of the answer is a stop. Before an action with real consequences, accepting terms, submitting a form that commits you, buying something, the loop pauses and asks a person. This is where the abstract turns into a decision you actually make. An agent that reads a staging site and reports what changed can run unattended all night. An agent with a saved payment method behind it needs someone at the gate, and the gate is a piece of software you write, not a habit you hope the model has.

A good failure arrives as information

Half of looking is looking at what went wrong. When an action fails, the executor should hand back a structured result saying so, with the reason attached. An unauthorized query that returns a clear refusal lets the agent switch to a read-only endpoint or ask for approval. A vague string, or no result at all, leaves it unable to separate success from a timeout from a denied permission, so it assumes things went fine and keeps going.

Given a real error, the agent can compare what it got against what it expected and change the next step instead of repeating the failed one. A plugin that rejects a column name gets called again with the right one. A selector that stopped matching because the interface moved needs fresh state first, since blind repetition is not recovery. Two limits keep this honest: cap the retries, or a reflective agent will circle forever on something it cannot fix, and remember that an agent reviewing itself catches less than an independent checker would. This is the same boundary described in What an Agent Loop Actually Is, pushed onto a surface built for human eyes. Anything that acts without looking again is not an agent. It is a recording.