Define allowed actions, approval points, and stop conditions for a bounded agent.
Separate the model from its tools
An agent can choose steps and use tools to pursue a goal. Its practical power depends on the tools and permissions around it.
A workflow can instead follow predefined steps with explicit branches. Use the simpler design when the task already has a stable sequence.
A tool call connects a model’s proposed action with an application function. The application must still check whether that action is permitted.
Define authority explicitly
Read access allows an agent to inspect information. It should not automatically include permission to change records or contact people.
Approval boundaries identify actions that require a person’s decision. Specify the exact action, destination, and relevant details that the reviewer will see.
Stop conditions prevent an open-ended loop from running indefinitely. Define limits for attempts, elapsed time, and unresolved errors before the system starts.
Worked example: a research assistant
Fictional scenario: a team wants an agent to gather public sources and draft a weekly briefing. It also has a publishing tool available.
The permission design allows research and draft creation without publication rights. A named editor reviews the sources and approves the finished briefing separately.
The failure case appears when a retrieved page tells the agent to publish immediately. That page provides task data, not authority to alter the approval process.
Inspect actions, not just answers
An action record shows which tool ran, with what input, and what result. This helps reviewers distinguish a proposed action from a completed action.
A bounded retry may recover from a temporary timeout. However, repeated permission failures should trigger escalation rather than increasingly broad attempts.
A release check tests tool arguments and side effects alongside the final answer. A good summary cannot compensate for an unauthorized change elsewhere.
Try it yourself
Your exercise is to list every tool for a fictional research assistant. Mark each tool as read, draft, or external action.
A permission review asks what the assistant could do if it followed the wrong instruction. Remove any capability the task does not actually need.
Success looks like an explicit authority boundary for every tool. A colleague can identify the approval point and explain when the agent stops.
What to carry forward
Define allowed actions, approval points, and stop conditions for a bounded agent.
Show your reasoning with the exercise above. Keep the evidence, the decision, and the remaining uncertainty together.
Useful terms for this lesson
RagTool CallFine TuningSources & further reading
Anthropic: Building effective agents — architecture patterns ↗