You want the messages Alice sent in a channel that holds a thousand of them. The agent calls the history tool, gets two hundred back, reads them, calls it again for the next page, reads those. Six calls in, the conversation is thick with text nobody asked for, and the model is still carrying the question it started with. The other version is twelve lines the agent writes itself: fetch the history, keep what came from Alice, return that. One turn. The thousand messages never touch the conversation, because they were only ever variables in a program that ran somewhere else.

The handles give way to a program

Think of a machinist at a manual mill. Every cut is his hands on the handwheels: a few turns, a look, a few turns back. The part exists as a sequence of decisions made one at a time, each one waiting on the result of the last. Nothing is wrong with that. It is only that the working and the deciding are the same motion, so the part takes as long as the deciding does.

The same shop with a numerically controlled machine works the other way round. The part is written down first — the order of the cuts, the depths, the conditions — and then the machine runs the whole sequence in one pass. That is what changes when a harness lets the model reach its tools from inside code. Instead of a model turn, a tool call, a result and another model turn for every step, the harness hands a short program one function that can invoke any registered tool. The model writes the program, the program does the coordinating, and a single consolidated result comes back. To compare the weather in two cities it calls the weather tool twice, works out the difference and returns one object. It never has to plan a second call after seeing the first.

Nobody stands inside while the machine runs

The gain is mostly round trips. When the latency of a task comes from orchestrating small steps rather than from any single step, folding the micro-workflow into one execution removes both the waiting and the tokens each intermediate result would have spent on its way through the context.

What you give up is the gaps. At the handwheels you can stop between two cuts, look at the work and change your mind. A program has no between: from outside it is one action, and while it runs the door is shut. If a workflow needs a person to approve or even watch each step, this is the wrong shape for it, and no amount of logging afterwards puts the gaps back.

The second thing that changes is how far a mistake travels. The program was written by the model, so the edge of its execution is a security surface and not a convenience — the alternative being an unbounded shell handed to a generator of plausible code. Give it the capabilities the task needs and not the credentials and directories sitting next to them. And the more surfaces share one environment, a browser and a shell and an editor on the same volume, the more a program that was only meant to convert a file can touch on its way past.

The machine underneath is meant to change

Once the action is code, the live question is where it runs, and that question has answers. One is to skip containers: a fresh JavaScript isolate per request, starting in milliseconds, loaded with pre-bundled modules and given a few typed stubs rather than a general API. It has no internet unless you grant some, and the hook on outbound traffic can attach a credential the code itself never sees. A narrow typed wrapper is less authority and fewer tokens at once. It is not a virtual machine, though; millisecond startup is not the same thing as isolation, and the two fail in different ways.

The other answer is to stop deciding once. A single runtime contract — create, run a command, read a file, tear down, with timeouts and network policy in the same vocabulary — lets an adapter put the identical program on Docker while you develop and on a hardened Kubernetes runtime in production, and lets policy demand stronger isolation for the risky tools without anyone touching the agent’s loop. It is the same move as drawing the trust boundary once, pushed a level down, where the boundary has become a parameter.

The agent’s action is a program now. The only thing left to design is where you let it run.