Do not begin with a framework or a list of tools. Begin with one task whose inputs, finish condition and failure cost you can describe. The first deliverable is an agent specification, not code.
1. Write a measurable mission
Weak mission: “Handle customer support.”
Bounded mission: “Classify incoming product questions, retrieve one approved policy article and draft a reply. Escalate billing, safety and account-change requests. Never send a reply.”
The bounded version makes success and prohibited actions visible.
2. Define the agent contract
| Field | Example |
|---|---|
| Trigger | New ticket in the review queue |
| Allowed input | Ticket text and approved help-center articles |
| Output | Category, cited policy and draft reply |
| Tools | Read ticket, search approved policy, save draft |
| Prohibited | Send message, change account, issue refund |
| Stop | Draft passes checks or case requires escalation |
| Owner | Support lead approves and monitors |
If a field is vague, the implementation will decide it accidentally.
3. Give each tool the least authority
Separate read, draft and execute permissions. A research agent may need to open sources but not publish a report. A scheduling agent may propose a time without sending invitations. Require approval for actions that are external, costly, irreversible or difficult to audit.
4. Design the loop and escape routes
For each cycle, state what the agent observes, the choices it may make and what counts as progress. Add limits for tool calls, time and repeated failures. Define when missing data becomes [NEEDS INPUT] rather than an excuse to guess.
5. Test failures before normal cases
Create cases with a missing source, contradictory policies, an unavailable tool, malicious instructions inside a document and a request outside scope. The expected result should name the safe action: refuse, mark the gap or escalate.
Only after the specification survives those tests should you choose an implementation stack. Framework features change; the task contract is what lets you evaluate any of them.
Frequently asked questions
Do I need multiple agents?
Usually not for a first version. Add another agent only when separate ownership, context or evaluation clearly improves the system. Otherwise coordination creates extra failure points.
What should an agent remember?
Only state needed for the task and permitted to persist. Separate short-lived run state from durable user or business data, with clear retention rules.
How do I know it is ready?
It consistently completes representative cases, stops safely on adversarial cases, produces an auditable trace and has a named human owner.