The agent is a constrained process participant
A bounded agent may plan and coordinate explicit workflow steps, but it is not the business authority. Identity systems, deterministic policy, narrow tools, budgets, human approvers, outcome verification, and rollback determine what can happen.
Separate planning from execution
The planner should produce a typed proposal containing goal, evidence, assumptions, tool, parameters, expected effect, verification, and recovery. It should not hold production credentials or directly decide that an action is authorized. Independent services validate the plan, evaluate policy, obtain approval when required, issue short-lived credentials, execute a narrow adapter, and verify the resulting state.
A bounded action contract
| Control | Minimum design |
|---|---|
| Process scope | Named triggers, inputs, states, allowed actions, prohibited actions, exceptions, termination, and owners. |
| Identity and permission | Separate workload identity, least privilege, resource and field scope, short-lived token, deny by default. |
| Tool boundary | Allowlisted operation with typed parameters; no generic shell, unrestricted browser, or administrator API. |
| Budget | Limits on steps, time, cost, records, recipients, retries, monetary exposure, and reachable risk tier. |
| Approval | Exact action, evidence, impact, risk, expiry, and recovery presented to an authorized person. |
| Verification and recovery | Authoritative read-back, idempotency, compensation, rollback, safe stop, and incident creation for uncertain state. |
| Audit | Correlated record of proposal, policy, approval, credential, execution, verification, failure, and rollback outside agent control. |
Good starting workflows
- Read-only research across approved sources with citations.
- Classification, extraction, and queue routing with low-confidence withholding.
- Internal draft preparation before external transmission.
- Reconciliation and proposed reversible updates to allowlisted fields.
- Evidence collection, ticket enrichment, or scheduling proposals under explicit policy.
Hard stops for the standard offer
- Unrestricted administrator, shell, database, browser, identity, or financial authority.
- Open-ended goals without testable completion and bounded side effects.
- Self-created agents, installed tools, policy edits, credential acquisition, or permission expansion.
- Final rights-, safety-, livelihood-, legal-, medical-, credit-, employment-, or eligibility-affecting decisions.
- Irreversible actions without an approval and a verified recovery method.
Measure execution, not plausibility
Acceptance tests must run real actions in a controlled environment and inspect the resulting state. Test success, parameter accuracy, authorization, duplicate requests, partial failure, dependency outage, indirect prompt injection, human rejection, cancellation, budget exhaustion, rollback, and the completeness of the audit trail.
