Agents need boring constraints

The most capable agent we have shipped has eleven tools, three of which can change something in the real world. The other eight only read. That ratio is not an accident — it is the design.

Separate reading from writing

Give an agent broad read access and narrow write access. Reads are cheap to audit and easy to reverse. Writes need an explicit contract: what can change, under which conditions, with what receipt. A refund tool that accepts an order ID and a bounded amount is safer than a general-purpose 'call this API' tool.

Budget attention like money

Every loop has a cost: tokens, latency, and the user's patience. Set hard step limits, per-task cost ceilings and a deadline. When the budget runs out, the agent should return its best partial result with an explanation, not keep thinking.

Design the refusal

The refusal is a feature. It should name what was missing, what it tried, and who can unblock it. A well-designed refusal is the difference between a user trusting the system and a user learning to ignore it.

Autonomy is earned per workflow, with evidence. Start with a human approving each action, measure where the human disagrees, fix those cases, then widen the boundary. That path produces agents people actually leave running.