An AI agent is a controlled decision loop
Production agents are useful when software has to interpret an objective, inspect current state, choose among approved operations and continue until a bounded outcome is reached. The key word is bounded. An agent should not inherit unrestricted application access simply because the model can call tools.
We treat the model as a planner inside an execution system. Identity, tenant context, authorization, business invariants, budgets, approval requirements and audit remain deterministic product controls outside the prompt.
Choose the smallest autonomy level that solves the problem
| Pattern | Model freedom | Good fit | Required control |
|---|---|---|---|
| Model step | Generate/classify once | Summaries, extraction, drafting | Schema and content validation |
| AI-assisted workflow | Model selects within a fixed sequence | Triage, routing, recommendations | Deterministic workflow state |
| Bounded agent | Iterative tool choice | Research, multi-step operations | Tool allow-list, budgets and stop conditions |
| Approval-gated agent | Plans consequential action | Publishing, payments, account changes | Durable human approval before side effect |
Many products labelled “agentic” are safer and easier to operate as AI-assisted workflows. Use iteration only where the benefit of dynamic planning is real.
Tool scope matters more than prompt wording
A tool is an API contract, not a natural-language permission. Prefer narrow domain commands such as createDraftProposal, requestRefundReview or scheduleFollowUp over generic database, shell or admin access. Each command must validate actor, tenant, resource ownership, arguments and current state on the server.
The model can suggest an action. It should not be able to redefine whether that action is permitted. This keeps authorization testable even when prompts, models or reasoning strategies change.
Put policy outside the model
Critical rules belong in code and data: which roles may invoke a tool, which objects may be accessed, transaction limits, maximum iterations, required approval classes, allowed destinations and stop conditions. Prompt instructions are useful context, but they are not an enforcement boundary.
This separation also improves portability. A model upgrade should not require re-proving the entire permission model because the same server-side policy still constrains every call.
Human-in-the-loop needs durable workflow state
A production approval step cannot be a transient modal that disappears when a request times out. Store the proposed action, supporting evidence, actor, policy reason, current resource version and approval decision. When the human responds, revalidate current state before executing because the underlying object may have changed.
Human review should be reserved for consequential or ambiguous steps. If every low-risk tool requires approval, the agent adds latency without reducing meaningful work. Risk tiers let the system automate reversible reads and drafts while gating irreversible writes.
Retries require idempotency and execution budgets
Agent loops naturally retry. Networks fail, model calls time out and a tool result can arrive after the orchestrator has lost its connection. Write operations therefore need idempotency keys or equivalent domain guards. The run itself should have limits for time, tool calls, tokens/cost and repeated identical actions.
A useful stop policy detects loops such as the same failing tool invoked with unchanged arguments. Instead of continuing to “reason”, the orchestrator should move to a repair, escalation or terminal state with a clear reason.
Memory is context, not the source of truth
Long-lived agent memory can improve continuity, but permissions, orders, invoices, bookings and customer records must still be read from authoritative systems. Store memory with provenance and scope. A remembered preference is different from a current entitlement or a verified account balance.
For multi-tenant software, memory retrieval also needs the same tenant and resource boundaries as ordinary application queries. A semantically relevant chunk is not automatically authorized context.
Evaluate trajectories, not only final text
Agent quality should be tested across the execution trace: Was the right tool selected? Were forbidden tools avoided? Did the run request approval at the correct boundary? Did it recover from a dependency failure? Did it stop within the budget? Was the final business state correct?
This is how we approach production AI automation and AI assistants at Softech: the useful product is the controlled path from intent to outcome, with evidence that the system stayed inside its operating envelope.
Production checklist
- Classify the minimum autonomy level needed for the task.
- Expose narrow domain tools, never broad administrative capability by default.
- Resolve authorization and tenant context outside the model.
- Persist approvals and revalidate state before execution.
- Make side-effecting tools retry-safe.
- Set run budgets and loop detection.
- Scope memory by tenant, resource and provenance.
- Evaluate tool trajectories, policy compliance and final domain state.