Why it matters
An agent moves beyond answering a question: it can plan steps, use product tools, and continue after the user leaves the chat. That makes its permissions, progress, and stopping rules a customer-facing feature, not just an implementation detail.
Long-running work can encounter retries, changed data, and actions that cannot be undone. The customer should know what was delegated, what the agent did, which step needs approval, and how to cancel or recover a run.
Decisions to make
- Define a narrow task and the exact tools and records the agent may use.
- Choose a run owner, expiration, concurrency limit, and spend or action budget.
- Decide which steps can be automatic and which require a named person to approve.
- Set retry, idempotency, and resume rules for long-running or interrupted work.
- Choose how users inspect progress, evidence, tool results, and final changes.
- Define cancellation and compensating actions for work that has already had an effect.
Build checklist
- Record each run with its goal, initiator, scope, state, and permitted actions.
- Enforce permissions in the underlying product APIs for every tool call.
- Pause at an explicit approval step before a consequential external or irreversible action.
- Make repeated tool calls safe and persist checkpoints so a run can resume or fail clearly.
- Show an activity trail and let the user stop a run or revoke its access.
- Test prompt injection, permission changes mid-run, duplicate execution, timeout, and cancellation.
Common mistakes
- Giving an agent a broad administrator credential because its first task is hard to scope.
- Calling a chat response a completed workflow before any real operation succeeds.
- Retrying a payment, email, or deletion without an idempotency rule.
Tools & references
3 starting points to compare or study. Check fit, maintenance, terms and current capabilities before choosing one.
