Steering
Correcting an Agent Mid-Flight
Prompting decides how an agent behaves before it starts. Steering changes that behaviour while it is running, without stopping it. It is the middle setting between letting a loop run to completion and killing it: the agent keeps its context, its progress and its plan, and something adjusts the direction it is heading. Authorisation policy refuses an action outright; steering redirects the agent before it asks.
What Can Be Steered
Steering is not one operation. These differ in how forcefully they land and how likely the agent is to drift back to its original course.
A new rule the agent must respect for the rest of the run: avoid a data source, stop using a tool, keep responses under a length. Additive, so it rarely conflicts with what the agent already believes.
Drifts back when: The constraint is stated once and never restated, so it falls out of an aggressively compacted context.
The objective is unchanged but its priorities shift: favour speed over thoroughness, correctness over coverage. The agent has to reinterpret work already done in the new light.
Drifts back when: The original goal statement still sits earlier in context, stating the old priority with equal authority.
Pointing the agent at something specific it has been ignoring: a file, an error, a constraint in the original request. Cheap and effective when the agent has simply lost the thread.
Drifts back when: The redirect is treated as one more item to handle rather than the thing that now matters most.
Removing a tool from the available set mid-run. Not really persuasion at all, since the capability disappears rather than being discouraged, which makes it the most reliable form.
Drifts back when: It does not. This is enforcement, which is why it belongs at the policy layer rather than in the prompt.
Discarding the agent's plan and substituting another. The bluntest instrument short of stopping, and it throws away whatever partial work the old plan produced.
Drifts back when: Fragments of the old plan survive in context and the agent completes steps belonging to a plan that no longer exists.
Changing tone, verbosity or format. The easiest to apply and the first thing to decay, because nothing in the loop reinforces it after the turn it was issued.
Drifts back when: Almost immediately. Register reverts within a few turns unless it is in the system prompt.
Where Steering Lands
The point in the loop at which a correction arrives determines both how quickly it takes effect and how much work it wastes.
| Injection Point | Mechanism | Takes Effect | Work Discarded |
|---|---|---|---|
| Between turns | A message appended before the next model call | Next turn | None |
| Mid-stream | Interception of a reasoning block before the response is composed | Within the current turn | Partial generation |
| At the tool boundary | A rejection carrying guidance in place of a tool result | Immediately, before the side effect | One tool call |
| On plan revision | Guidance supplied at an explicit replanning step | Next planning cycle | None, but it may be a long wait |
| Into memory | A durable note written to long-term store | Whenever it is next retrieved | None, and it may never land |
| Restart with context | Terminate and relaunch carrying a summary plus the correction | Immediate | The entire run |
Who Does the Steering
Steering is usually discussed as a human operation, but in production most of it is automatic. The steerer needs a view the agent lacks, which is why it is nearly always a separate process rather than the agent reflecting on itself.
Someone watching the run and correcting it. Rare in production because it does not scale, and disproportionately valuable during development because a person spots category errors instantly.
Sees what the agent cannot: What the user actually wanted, as opposed to what they typed.
A separate model watching the action stream and injecting corrections when the trajectory drifts. Effective only if it runs on a different prompt and context from the agent it watches.
Sees what the agent cannot: The shape of the whole trajectory, rather than the current turn.
In a dual-process architecture the deliberative loop steers the reactive one continuously, handing back plans and belief updates rather than exceptional corrections. Steering is the normal mode of operation, not an intervention.
Sees what the agent cannot: The result of reasoning the fast loop had no time to perform.
A denial that carries a reason is a steer. Refusing an action and explaining why redirects the agent far more usefully than a bare error, which invites it to retry the same thing.
Sees what the agent cannot: Rules the agent was never shown, and should not be trusted to enforce.
A judge returning RETRY with feedback is steering with a quality signal attached. The most structured form available, because the correction arrives bound to a specific rejected output.
Sees what the agent cannot: A rubric the agent is not scored against by itself.
A mid-task correction typed into the conversation. Often the strongest signal available and frequently the worst handled, because it arrives as an ordinary message competing with everything else in context.
Sees what the agent cannot: Ground truth about the goal, which nothing else in the system has.
The slow brain case is the one worth dwelling on. In a dual-process architecture the deliberative loop is not merely advising, it is steering: its output is a plan or belief update that conditions the fast loop already in flight. Every problem on this page applies to that handoff, and the staleness described there is exactly the stale-steer failure below.
Failure Modes
The correction is appended as another context message and the agent weighs it equally with everything before it. Recency helps, but a correction competing with a long, confident plan usually loses.
Fix: Give corrections structural priority rather than positional priority. A dedicated field the loop reads explicitly beats a message hoping to be noticed.
The steer contradicts a standing instruction, so the agent oscillates between them or picks the one with more authority, which is usually the system prompt. The correction appears to have been received and then quietly loses.
Fix: Make the precedence explicit. Steering must be able to override standing instructions or it is advice, and the agent should say when it cannot comply.
The correction was computed against a state the agent has already moved past, so it lands on work that no longer exists. The characteristic failure of asynchronous steerers, including a slow brain running behind a fast one.
Fix: Version every steer against the state it was derived from, and have the agent discard corrections whose premise no longer holds.
Corrections arrive faster than the agent can act on them, so it spends the run reorienting instead of working. Common with an eager guardian, and it looks like the agent has become incompetent.
Fix: Rate-limit corrections and require a minimum of progress between them. Let the agent finish a step before judging its direction.
The correction surfaces in user-visible output, so the user reads "I have been told to avoid discussing pricing" instead of a normal answer. The control becomes an obvious seam in the product.
Fix: Keep steering out of the response channel. Treat it as instruction to the agent, not as content, and test that corrections never reach the transcript.
The trajectory is later reviewed and the agent appears to have changed direction for no reason, because the correction was injected without being logged alongside the actions it changed.
Fix: Log every steer with its source, timestamp and target state, and render it in the trace next to the behaviour it produced.
Where This Sits
Steering is the soft control between doing nothing and stopping. Authorisation Policy is the hard refusal it sits above, and Stream Safeguards is the implementation of mid-stream steering, intercepting reasoning blocks and redirecting before a response is composed. Judge and Escalation supplies the RETRY verdict, which is steering with feedback attached. Fast and Slow Brain is the architecture where steering is continuous rather than exceptional, and Agentic Loops covers the oscillation that conflicting corrections produce.