A durable handle or an open call: what changes when an agent step runs long

Most agent designs assume a tool call returns while the model is still waiting. Then a step starts doing real work: rendering a video, crawling a market, rebuilding an index. It is still one entry in the tool list, but it now outlives the request that started it. The Model Context Protocol specification names this case and gives it a shape: Tasks, asynchronous execution of long-running operations with polling, mid-flight input and durable handles.

A long step is not a slow step

A slow step costs latency. A long step changes who owns the state. While the operation runs, progress lives somewhere other than the model's context: a queue, a worker, a downstream system. If the orchestrator restarts, a slow call can simply be reissued. A long one may still be running, and reissuing it does the work twice. The difference is ownership, not duration.

The specification is explicit that tools represent arbitrary code execution and must be treated with appropriate caution. That caution is sharper here, because the window in which the operation can go wrong is also the window in which nobody is holding the result. An open call hides that window. A task makes it something you can name, inspect and hand to a different process when the one that started it is gone.

What polling, mid-flight input and durable handles each buy

A durable handle changes the question the agent asks after a failure. Instead of deciding whether to run the step again, it asks what became of the operation it already started. Anthropic's account of its multi-agent research system describes building systems that resume from where the agent was when errors occurred, and combining the adaptability of agents with deterministic safeguards like retry logic and regular checkpoints.

Polling turns an open connection into a state you can read. That matters for control, because a maximum number of iterations is a common stopping condition, and an agent blocked on one long call burns no iterations while making no progress. A readable task state lets a supervisor distinguish between still working, finished and stuck without inferring any of it from silence on a socket.

Mid-flight input is where human approval can sit. OWASP's guidance on Excessive Agency recommends human-in-the-loop control so that a person approves high-impact actions before they are taken. A task that accepts input while running gives that approval somewhere to land without pausing everything around it. The same guidance adds that authorisation belongs in downstream systems rather than in a model deciding whether an action is allowed.

Recovery still needs checkpoints

A durable handle tells you the operation survived. It does not tell you what the agent had already concluded before it started waiting. The multi-agent write-up describes patterns where agents summarise completed work phases and store essential information in external memory before proceeding to new tasks. Without that, a resumed run recovers the tool result and loses the reasoning that justified calling the tool in the first place.

Pair the two deliberately: the handle restores the external operation, the checkpoint restores the agent's own position. Treat the checkpoint as a write that happens at a phase boundary, not as something reconstructed from logs afterwards. If a step is long enough to deserve a task, the work preceding it is long enough to deserve a summary committed to external memory before the wait begins.

The cost line and the rate limit

Long operations tempt you to poll inside the agent loop, which puts every poll into context. That compounds a profile that is already heavy: in Anthropic's data, agents typically use about 4× more tokens than chat interactions, and multi-agent systems about 15× more tokens than chats. Polling outside the model's context, and resuming with a summary rather than a transcript, keeps the wait from being charged as reasoning.

Rate limits belong on the task side too. OWASP recommends rate-limiting to reduce the number of undesirable actions possible within a given time period, and a durable handle makes that enforceable: you can count operations in flight rather than calls attempted. Anthropic's guidance on agents notes that autonomy brings higher costs and the potential for compounding errors, and recommends extensive testing in sandboxed environments with appropriate guardrails.

Before adding another tool, ask which entries in the list can outlive the request that calls them. For each of those, decide three things: what handle survives a restart, what state a supervisor can read without the model, and what summary is written before the wait starts. Steps that cannot answer all three should stay synchronous until they can, because an open call with no handle is a step you cannot resume or stop.

Sources

Model Context Protocol — Specification (version 2026-07-28) — https://modelcontextprotocol.io/specification/2026-07-28

Anthropic — How we built our multi-agent research system — https://www.anthropic.com/engineering/multi-agent-research-system

OWASP Gen AI Security Project — LLM06:2025 Excessive Agency — https://genai.owasp.org/llmrisk/llm062025-excessive-agency/

Anthropic — Building effective agents — https://www.anthropic.com/engineering/building-effective-agents