Agent safety
How much authority can this agent safely hold?
Limit what an agent may do by action, approval, and reversibility, then define how a person stops, inspects, and recovers the workflow.
DECISION BRANCH
Do not begin with the tool name.
- ASK FIRST↓
Is the missing piece a fact, a standard, or model capability?
- IF↓
The result is verifiable and the failure cost is bounded, expand carefully.
- OTHERWISE✓
Narrow the action, keep the human handoff, and preserve recovery.
WORKED CASE
May a refund agent proceed all the way to payment?
The agent reads tickets, queries orders, calculates refunds, writes to CRM, and may call a payment tool. Read-only steps and balance-changing actions sit inside the same workflow.
Add one human confirmation at the final button without showing evidence or changes, and ignore duplicate requests and tool timeouts.
Assign authority by action: reads may run, calculations leave evidence, CRM drafts stay reversible, and payment requires explicit approval with order, amount, and rationale. Save idempotency and recovery state at each step.
Rehearse duplicate requests, payment timeouts, abnormal amounts, and rejected approvals. No duplicate refund occurs, the workflow stops safely, and the operator can continue, reverse, or close from the record.
ENTRY & EXIT SIGNALS
Know when to enter—and when the decision is good enough to leave.
A topic is not an endless knowledge directory. Entry signals tell you whether the problem belongs at this layer. Exit signals decide whether to continue instead of substituting time spent reading for work completed.
- An agent will write to systems or notify people
- Human approval occurs after the outcome can no longer change
- Duplicate execution, timeout, or partial success lacks recovery
- Every action has authority, an owner, and an observation record
- High-impact actions show evidence before explicit approval
- At least one failure has been rehearsed to a safe state
3 PRACTICES
Build the judgment, make the artifact, then review it with real cases.
BOUNDARY
What this topic page will not do
The permission ladder guides control design; it is not organizational authorization or a security certification. Verify reversibility in the real system.