Separate reasoning from authority
An agent can analyze repositories, documents, chain events, alerts, and tickets without receiving authority to execute every proposed action. Keep recommendation, preparation, approval, signing, execution, and verification as distinct steps. The model may draft a transaction or change, while a policy layer and named human decide whether it can proceed.
Wallet and infrastructure permissions should be narrow, revocable, environment-specific, and observable. High-impact actions such as upgrades, transfers, role changes, production deployments, or incident shutdowns should require explicit approval outside the model context.
Build typed tools and policy gates
Agents are safer when tools expose structured inputs and outputs instead of arbitrary shell, database, or RPC access. Validate addresses, chain IDs, amounts, repository refs, environment names, and allowed actions at the tool boundary. Use allowlists, spending or rate limits, dry-run modes, and policy checks that cannot be overridden by natural-language prompts.
Retrieved documents and external content are untrusted data. Keep system policy separate, limit tool selection based on user role, and prevent retrieved text from silently changing permissions or destinations.
Evaluate workflows, not only model answers
Production evals should measure whether the full workflow selected the correct source, respected policy, used the right tool, preserved required fields, requested approval, handled failure, and verified the outcome. Create test cases for ambiguous requests, malicious content, stale data, missing credentials, conflicting sources, and partial tool failures.
Track false approvals and unsafe omissions separately from general answer quality. A fluent explanation is not evidence that an operational task was executed correctly.
Keep an audit trail
Record the initiating user, input references, model and prompt version, retrieved sources, proposed action, policy decision, approver, tool arguments, tool result, external receipt, and final verification. Redact secrets and personal data while retaining enough structure for incident review and regression testing.
Version prompts, tools, policies, and eval sets with the application. Changes to any of them can alter behavior and should move through review, staged deployment, monitoring, and rollback like other production code.
Define failure and handoff
Every automated workflow needs timeouts, retries, idempotency, escalation, and a manual completion path. Operators should be able to pause the agent, revoke credentials, inspect queued work, replay from a safe checkpoint, and verify external state. Acceptance evidence includes eval results, policy tests, approval records, tool traces, monitoring, and an incident runbook.