Agents that are allowed to do less than you think, and audited for all of it

The assessment exists mostly to talk you out of the expensive version. The output states which steps of a process genuinely need autonomy, which are better as deterministic code, and which should not be automated at all.

• Process decomposed step by step. Each step classified as deterministic, needs judgement, or must stay human, with the reasoning recorded so the design can be challenged later.
• Autonomy justified per step. A model is given control flow only where the branches genuinely cannot be enumerated, because every autonomous step is a reliability and cost risk.
• Blast radius assessed before tools. What the worst wrong action would cost, whether it is reversible and who would notice, decided before any tool is put within reach of a model.
• Tool inventory and permission mapping. Every system the workflow must touch, the identity it will use and the narrowest permission that still works.
• Cost modelled at worst-case iterations. Token and tool cost per run estimated at expected and pathological loop counts, since a retrying agent multiplies its own bill.
• Preview and maturity risk stated. Which platform capabilities in the design are preview rather than generally available, recorded with the date checked because this area renames fast.

The pattern we default to is a deterministic state machine that owns the workflow, calling a reasoning step where judgement is needed. Multi-agent topologies are used where the work genuinely decomposes, not because the architecture diagram looks better.

• Deterministic orchestrator owns control flow. Branching, retries, timeouts, parallelism and human approval held in a state machine rather than in a prompt, so failures are recoverable and traceable.
• Tools declared, validated and allowlisted. An explicit schema per tool with argument validation, so a malformed or manipulated model output cannot become an arbitrary call.
• One governed gateway for tool access. Existing APIs exposed to agents through a single governed endpoint rather than credentials distributed into agent code.
• Memory scoped deliberately. Short-term conversation state separated from anything persisted across sessions, with a decision recorded about what is allowed to survive a run.
• Retrieved content treated as untrusted. Documents, web pages and tool responses can carry instructions, so retrieved text is never allowed to widen what an agent may do.
• Idempotency on every write. Business-system writes made safe to repeat, because an agent that retries will eventually retry a step that already succeeded.

Agents break the assumption that a request has a human behind it. Identity, authorisation and audit all need rethinking, and prompt injection stops being an embarrassment and becomes a privilege-escalation route.

• An identity per agent. Each agent authenticates as itself or on behalf of a named user, so an audit log entry resolves to something specific rather than a shared secret.
• Delegated authority, never borrowed. Where an agent acts for a user it carries that user's entitlements rather than a broad service permission that would let it exceed them.
• Action policy enforced outside the model. Tool calls intercepted and checked against policy before execution, because a guardrail expressed only in a system prompt is a suggestion.
• Injection treated as privilege escalation. Adversarial cases added to the evaluation suite, and tool allowlists enforced so a hostile document cannot talk an agent into a wider action.
• Full trajectory logged. Every model call, tool invocation, argument set and handoff captured, since a final answer alone cannot be audited or debugged.
• An agent inventory that is maintained. Who owns each agent, what it may reach and when it was last reviewed, because ungoverned agent sprawl is the predictable next problem.

Agentic systems fail adoption in a specific way: people either trust them too much for a while and then not at all after one bad outcome. The work is calibrating that trust deliberately.

• Approval steps designed to be usable. A reviewer sees what the agent proposes, why, and the evidence behind it, because an approval nobody can meaningfully assess becomes a rubber stamp.
• Autonomy widened in stages. Start with propose-only, move to approve-then-act, and only then consider unattended action for low-consequence steps, with a decision at each gate.
• Failure behaviour taught, not hidden. Staff shown how the agent fails and what to do about it, so the first bad output is recognised rather than treated as a betrayal.
• Escalation path built before scale. A clear route to a person when the agent is uncertain, blocked or wrong, resourced before volume arrives rather than after complaints do.
• Trajectories reviewed with the process owner. Real runs walked through weekly during the pilot, which surfaces more design problems than any amount of prompt tuning.
• Measured against the baseline, not the vibe. Assessed on the agreed evaluation set and process metrics rather than user sentiment, because self-reported speed-ups are demonstrably unreliable.

Agent systems degrade faster than anything else we operate. Models change underneath them, tool APIs move, and a workflow that scored well in March can quietly stop finishing in June.

• Evaluation suite run on every change. Model updates, prompt edits and tool changes all re-scored against the held-back set, with a regression blocking promotion rather than being noted.
• Trajectory sampling by a human. A sample of real runs reviewed on a cadence, because aggregate success rates hide the specific failure that will embarrass you.
• Cost per run trended. Token and tool spend per completed run tracked over time, since a model change or a new retry pattern can double cost without any code change.
• Tool and API drift monitored. Downstream schema and permission changes detected before they turn into silent failures inside an agent loop.
• Preview capability tracking. Anything in the design that is preview watched for change, since this area renames and deprecates faster than any other platform area.
• Agent register reviewed. Ownership, reachable tools and approval points revisited on a cycle, with unused agents retired rather than left with live permissions.