AI agents that are allowed to act only where action is safe

I build AI agents for companies that have a workflow with tools a model can call — search, tickets, CRMs, internal APIs — and that cannot afford unsupervised side effects. An agent is not a smarter chatbot. It is a loop: observe, choose a tool, validate the result, stop. The engineering is in the tools, the permissions, the stop conditions, and the evaluation set. I will recommend a single-shot structured call or a deterministic workflow when an agent would only add a loop around a task that did not need one. Reliability is the product; autonomy is a risk you take on purpose.

Who this is for

Product teams adding an assistant that must use internal tools, not only generate text.
Operations teams with repetitive multi-step work that still needs judgement.
Platform teams who have been asked for 'an agent' and need to reduce it to an architecture.

Problems agents are for — and are not

A copilot must read from several systems and propose a next action.
The prototype agent loops, double-books, or emails the wrong person.
Leadership wants agents; the domain needs a state machine with an LLM at one step.

What I design

Tool interfaces with typed inputs, idempotency, and least privilege.
Planner-versus-executor splits so the model cannot both invent and commit.
Stop conditions, timeouts, and budget caps on tool calls.
Evaluation: scripted trajectories, failure taxonomies, and regression sets.
Human approval for irreversible actions.

How I decide whether you need an agent

If the steps are known, use a workflow. If the next step depends on messy input but the tools are few, use a router. If the model must discover a path through many tools, then — and only then — an agent loop, with a hard cap and an audit log. Most commercial 'agent' requests collapse to a router plus three tools.

What makes an agent reliable enough to ship

Reliability is not a prompt. It is the same discipline as any distributed worker, plus a probabilistic planner.

Permissions are not prompt text

A model instructed 'do not delete' will still call delete if the tool is available. Enforce in the tool layer.

Every tool call needs a receipt

Idempotency keys, structured errors, and traces. An agent that cannot explain which tool ran is not debuggable.

Cap the loop

Unbounded ReAct is a cost and safety incident. Set a maximum steps, a wall clock, and a dollar budget.

Evaluate trajectories, not vibes

Hold-out tasks with known good tool sequences. If you cannot write ten, you cannot tell whether a change helped.

Separate propose from commit

Draft the ticket; a human or a rules gate publishes it. The more irreversible the action, the stricter the gate.

Agent failure modes

Giving the model a browser and production credentials 'to be helpful'.
No simulation environment, so evals hit live customers.
Treating multi-agent debate as a substitute for a specification.
Hiding a workflow behind an agent because the workflow was never designed.

Deliverables

An architecture decision: workflow, router, or agent — with reasons.
Tool contracts and a permission model.
A runnable agent or copilot with traces and caps.
An eval set the team can run in CI.

Selected work

Genie Platforms — AI-native sales copilots aligning outbound, nurture, and RevOps choreography without abandoning instrumentation.
TIVA — Ambient voice and text retrieval that meets teams where they work — not another siloed search screen.

Related services

AI integration — Put a model inside an existing workflow, with contracts and a way out — not beside the product as a chatbot.
AI automation — Remove the manual bottleneck in a live operation: rules first, models only where the input is messy.
Software architecture — System design for live products: what should exist, where the boundaries sit, and how the system fails.

Related insights

When to add an LLM to an existing product — and when you should not

Questions I am asked

When should you use an AI agent?

When the next action cannot be tabulated in advance, the tools are well-defined, and failure is recoverable or gated. If you can write the flowchart, write the flowchart. Agents are for residual ambiguity, not for skipping product design.