Every agent we deploy ships with two lists. The first is what it handles alone. The second, which takes longer to write, is what it must never decide.
Draw the line before launch
Refunds above a threshold, anything legal, a customer who is clearly upset: these go to a person, with the full conversation attached so nobody has to repeat themselves. The handoff is part of the product, not a failure of it.
Small permissions, visible logs
An agent should hold the narrowest access that lets it finish the task, and every action it takes should be readable afterwards in plain language. If you cannot explain what it did yesterday, it has too much room.
Teams that start with tight limits widen them quickly, because trust is earned in the logs. Teams that start wide spend the first month apologising.
