The question of which loops get to write
Read access is cheap. Write access is the whole design problem.
Most of the interesting decisions in agent orchestration are not about which model to call. They are about what that model is allowed to touch once it starts working. A loop that can read a codebase, search it, and suggest a diff is low risk. The moment it can write to that codebase without a human in the loop, every assumption about correctness has to hold at once, not just on average.
I spent a long stretch designing the routing layer that decided which agent handled which ticket. The interesting part was never the routing table. It was deciding, for each subtask, how much write access the agent actually needed to do the job, and refusing to give it more than that even when giving it more would have been faster in the short run.
Boundaries as the actual product
The loops that stayed reliable were the ones with a hard line around file scope, tool access, and a clear handoff back to review. The ones I trusted to police themselves did not stay reliable, no matter how good the underlying model got. That is the part of this work that will not go away as models improve: someone still has to decide which loop gets to write, and what happens when it is wrong.