# AI agents that are allowed to act only where action is safe

I build AI agents for companies that have a workflow with tools a model can call — search, tickets, CRMs, internal APIs — and that cannot afford unsupervised side effects. An agent is not a smarter chatbot. It is a loop: observe, choose a tool, validate the result, stop. The engineering is in the tools, the permissions, the stop conditions, and the evaluation set. I will recommend a single-shot structured call or a deterministic workflow when an agent would only add a loop around a task that did not need one. Reliability is the product; autonomy is a risk you take on purpose.

## Who this is for
- Product teams adding an assistant that must use internal tools, not only generate text.
- Operations teams with repetitive multi-step work that still needs judgement.
- Platform teams who have been asked for 'an agent' and need to reduce it to an architecture.

## What makes an agent reliable enough to ship
Reliability is not a prompt. It is the same discipline as any distributed worker, plus a probabilistic planner.
### Permissions are not prompt text
A model instructed 'do not delete' will still call delete if the tool is available. Enforce in the tool layer.

### Every tool call needs a receipt
Idempotency keys, structured errors, and traces. An agent that cannot explain which tool ran is not debuggable.

### Cap the loop
Unbounded ReAct is a cost and safety incident. Set a maximum steps, a wall clock, and a dollar budget.

### Evaluate trajectories, not vibes
Hold-out tasks with known good tool sequences. If you cannot write ten, you cannot tell whether a change helped.

### Separate propose from commit
Draft the ticket; a human or a rules gate publishes it. The more irreversible the action, the stricter the gate.


Canonical: https://ihar-ivaniuk.com/en/services/ai-agents