Start with one bounded job
A credible pilot does not need broad autonomy. It needs a valuable task, an authenticated user, approved information sources and a clear definition of when the agent must stop.
Write the boundary before writing the instructions: what the agent may read, which actions it may invoke, what requires confirmation and which intents always escalate.
Actions inherit system risk
An agent action should expose less authority than the underlying automation, not more. Apply object, field and record access in the action layer and return predictable outputs that the agent can explain.
- Collect only inputs required for the action.
- Show a concise preview before a write.
- Require explicit confirmation in the current interaction.
- Log the action outcome without storing secrets in transcripts.
Design escalation as success
Security, legal, regulated and uncertain intents should reach a person with structured context. The agent does not fail when it escalates correctly; it completes the safe path that was designed for that risk class.
Evaluate behavior, not just answers
Test missing information, denied permissions, prompt injection, cross-customer requests and ambiguous intent alongside normal conversations. The important evidence is whether the agent chooses the correct action boundary consistently.