Start from authority, not capability
An agent might be technically capable of calling a payment or CRM API. That does not mean it should. Authority comes from the authenticated user and the business rules associated with that person, not from natural-language persuasion.
Practical takeaway: Design tool permissions around narrow tasks and short-lived credentials.
Describe the job in observable steps
“Handle the customer” is not a useful specification. “Retrieve eligible order items, explain refund choices, and request confirmation before submitting a ticket” provides clear boundaries and test points.
Practical takeaway: Represent workflow states and end conditions explicitly.
Treat tool results as untrusted
Webpages, documents and external systems may include malicious or misleading instructions. Separate source content from system instructions and validate all tool inputs and outputs.
Practical takeaway: Do not let retrieved text redefine permissions or bypass policy.
Make side effects visible
An agent should signal when it is about to send an email, change an account setting or place an order. An authorized person should be able to cancel or correct important changes.
Practical takeaway: Use preview-and-confirm patterns for consequential actions.
Plan failures in advance
Models may return malformed instructions; APIs may time out; source data may be stale. Define retry behavior, stop conditions, duplicate prevention and escalation to a human.
Practical takeaway: Test incomplete context, revoked permissions, rate limits and adverse content.
Evaluate workflows, not just final text
Measure whether the agent selected authorized tools, used correct data, achieved task outcomes and produced an understandable explanation.
Practical takeaway: Trace enough execution context to debug without retaining unnecessary secrets.
Where to go from here
A useful next step is to translate these principles into a written product decision: who owns the workflow, what data may be used, how success will be evaluated and what happens when the system is unsure.