Demos are single turns. Work is a loop.
Ask a model to draft a reply and you get a reply. Ask it to handle a lead and you get something subtler: read the message, check the CRM, enrich the company, score the fit, check the calendar, draft the response, update the record, notify the owner. Each step can fail differently, and a demo conveniently exercises none of the failure paths.
Production agents are built as loops with state, not as single completions. The agent plans, acts through tools, verifies the result, and either continues, retries or escalates. That structure, more than any prompting technique, is what makes the difference between eight reliable steps out of ten and a system you can put in front of customers.
Permission design is the real safety mechanism
The question people ask is how to stop the agent doing something wrong. The better question is what the agent is able to do at all. Tools should be narrow, named and permission-scoped: this agent may read the CRM, draft messages and create calendar holds, and nothing else. Consequential actions (send, charge, delete) sit behind approval until their evaluation results earn autonomy.
This is unglamorous work, and it is most of the work. An agent with five well-scoped tools and clear escalation beats a brilliant agent with write access to everything.
Evaluate before you trust
An agent should be measured against a test set of real cases before launch, with accuracy, cost and latency tracked per run. The test set comes from your actual history: the hundred real requests that show the spread of what the agent will face.
After launch, the evaluation runs continuously. Models change, prompts drift, the mix of incoming work shifts. A regression suite for agents is the same idea as one for software: you find out in staging that quality dropped, not from a customer.
Where agents earn their keep first
The best first agents share three properties: the task is high-volume, the rules are mostly explicit, and a human is already doing it well enough to define done. Lead qualification, support triage, document intake and report assembly are the classics for a reason.
The worst first agents are the reverse: low volume, implicit rules and no definition of done. If you cannot write down what a good outcome looks like, no agent can aim at it.
- Start where volume makes the economics obvious
- Write the definition of done before the first prompt
- Ship with approval gates, then widen autonomy on evidence