How an agent harness runs a model and enforces limits

The Agent SDK documentation says that when you start an agent, Claude evaluates the prompt, calls tools to take action, receives the results, and repeats until the task is complete.

When you start an agent, the SDK runs the same execution loop that powers Claude Code: Claude evaluates your prompt, calls tools to take action, receives the results, and repeats until the task is complete.

The documentation's loop description says: "Execute tools. The SDK runs each requested tool and collects the results."

Execute tools. The SDK runs each requested tool and collects the results. Each set of tool results feeds back to Claude for the next decision.

The documentation says: "Claude determines which tools to call based on the task, but you control whether those calls are allowed to execute."

Claude determines which tools to call based on the task, but you control whether those calls are allowed to execute.

The documentation says disallowed tools are blocked "regardless of other settings", and that when a tool is denied Claude receives a rejection message as the tool result.

disallowed_tools / disallowedTools blocks listed tools, regardless of other settings. ... When a tool is denied, Claude receives a rejection message as the tool result and typically attempts a different approach or reports that it couldn't proceed.

The documentation says the loop can be capped with a maximum number of tool-use turns or with an estimated spend in US dollars, and that spend can pass the budget cap by up to the cost of the response that reaches it.

You can cap the loop with max_turns / maxTurns, which counts tool-use turns only. ... You can also use max_budget_usd / maxBudgetUsd to cap turns based on a spend threshold. ... Max budget (max_budget_usd / maxBudgetUsd) | Estimated spend at which the loop stops ... Spend can therefore pass the cap by up to the cost of that one response

The documentation says hooks run in the application process, not inside the agent's context window, and that a PreToolUse hook that rejects a tool call prevents it from executing.

Hooks run in your application process, not inside the agent's context window, so they don't consume context. Hooks can also short-circuit the loop: a PreToolUse hook that rejects a tool call prevents it from executing, and Claude receives the rejection message instead.

The documentation says the auto permission mode uses a model classifier to review actions such as shell commands and network requests, allowing or blocking each one it reviews.

auto | Uses a model classifier to review actions such as shell commands and network requests, allowing or blocking each one it reviews.

Anthropic's engineering post of 26 November 2025 calls the Claude Agent SDK "a powerful, general-purpose agent harness adept at coding".

Published Nov 26, 2025 ... The Claude Agent SDK is a powerful, general-purpose agent harness adept at coding, as well as other tasks that require the model to use tools to gather context, plan, and execute.

Anthropic's post says the core challenge of long-running agents is that they "must work in discrete sessions", and that each new session starts with no memory of earlier ones.

The core challenge of long-running agents is that they must work in discrete sessions, and each new session begins with no memory of what came before.

Anthropic's post describes a progress file and git commits as the way a new session learns the state of the work.

The key insight here was finding a way for agents to quickly understand the state of work when starting with a fresh context window, which is accomplished with the claude-progress.txt file alongside the git history.

In Anthropic's post the initializer agent wrote over 200 features as JSON for a claude.ai clone, each initially marked as failing, and Anthropic prompted the coding agents, with strongly worded instructions, to edit the file only by changing the passes field.

In the claude.ai clone example, this meant over 200 features ... These features were all initially marked as failing ... We prompt coding agents to edit this file only by changing the status of a passes field, and we use strongly-worded instructions like It is unacceptable to remove or edit tests

Claude Code's hooks guide says hooks give "deterministic control: certain actions always happen rather than relying on the LLM to choose to run them".