These are the working rules I would publish on day one of an agent program. Each tab answers the question teams ask in practice, then gives the practices that follow from the answer.
No. Expose capabilities, not systems. An MCP server that mirrors a CRM's full API gives an agent hundreds of ways to be wrong. One that offers eight well-named business operations gives it eight. The integration layer is where you decide how much surface area the agent gets, and that decision matters more than the model you pick.
Name a tool for the outcome rather than the endpoint. "Issue a policy refund" beats "POST /v2/transactions". Fewer, clearer, coarser-grained tools produce better plans and far fewer failed calls.
The description is the interface contract the model reads. Review it, version it, test it. Include what the tool does not do and when not to use it. Ambiguity in a description shows up as a wrong action in production.
Signed, version-pinned, scanned, with an owner per server. Public MCP servers get vendored in and reviewed like any third-party dependency. Tool squatting is a live risk once agents discover tools dynamically.
Different servers, different credentials, different approval rules. Most agent value is read-side. Keeping the write surface small and explicit is what lets the read side move fast.
Idempotency keys on every mutating call, and a documented compensating action. Agents retry. Without idempotency, a retry becomes a duplicate payment.
MCP connects an agent to tools and context. A2A lets agents delegate to each other across teams, frameworks and vendors. Mixing the two roles produces a mesh nobody can reason about.
Agents bind to schemas. Additive changes only, deprecation windows published, contract tests in CI. A renamed parameter is a production incident.
An API response, a retrieved document or a peer agent's message can carry injected instructions. Screen everything on the way back in, including whatever the tools return.
When the path to the outcome varies by case and cannot be enumerated up front. If you can draw the flowchart, build the workflow. Agents earn their complexity on ambiguous, long-tail work. Using one for a deterministic process adds cost, latency and a new class of failure for no gain.
One agent, few tools, tight scope. Multi-agent systems multiply coordination failures. Add a second agent when a single one demonstrably cannot hold the task. A tidier diagram is not a reason.
Let a workflow engine own sequencing, retries, state and compensation. Let the agent own judgment. This hybrid is what makes long-running agent processes survivable in production.
What happens when the model is unavailable, the tool times out, the plan loops, or the answer is wrong. Write those four paths before the happy path. They are most of the operational work.
Ship it as a scaffold: a repository template that already has the gateway client, tracing, eval harness, prompt registry and agent card wired in. Adoption follows convenience.
One agent, one purpose, one permission set, one tenant scope. Shared agents accumulate permissions until nobody can say what they can reach.
Route through a model gateway, keep prompts in a registry, keep evals model-agnostic. The best model for a step changes roughly every quarter, and you want that to be a config change.
Supervisor and workers for delegation. Sequential pipeline for staged transformation. Peer network only where a real organizational boundary exists. Name the pattern in the design document.
Certified skills, a shared eval library, standard prompt scaffolds, a golden-path deployment pipeline. A platform that saves a team three weeks gets adopted without a mandate.
Rarely. Attention quality degrades as the window fills, so more tokens often means worse decisions and higher cost. Context engineering is the discipline of putting the smallest sufficient set of information in front of the model at each step. It usually beats both a larger window and a larger model.
Frontier models for hard planning and ambiguous judgment. Small or tuned models for classification, extraction and routing. Most agent steps do not need the largest model, and the cost difference compounds fast.
A registry with review, diff, test and rollback. A prompt change is a behavior change and deserves the same release discipline as a deployment.
When the window fills, summarize and restart with the summary. Tune the compaction prompt against real traces and optimize for recall first. What gets dropped is a design decision.
A subagent can burn tens of thousands of tokens exploring and return a two-thousand-token answer. The orchestrator stays focused and the detail stays isolated where it belongs.
Every durable memory entry records where it came from, which task wrote it, who it belongs to and when it expires. Without provenance you cannot detect poisoning or honor a deletion request.
Apply the user's entitlements at the chunk level, then rank. Filtering after retrieval leaks through relevance scores, citation counts and summaries.
Agents fail on enterprise vocabulary long before they fail on reasoning. A shared model of entities and relationships turns "active customer" from an argument into a lookup.
Role and constraints, task contract, tool schemas, retrieved evidence, working state. A predictable layout makes behavior reproducible and regressions traceable to one layer.
You stop testing for a fixed string and start testing for properties: did it reach the right outcome, use permitted tools, stay grounded in its sources, and respect its budget. Then you run that suite continuously, because a passing test on Monday says nothing about Thursday's model update.
Component (does this tool call work), step (was this the right action), trajectory (was the whole path sound), and outcome (did the business result happen). A good outcome from a bad trajectory is a latent incident.
Cases drawn from production beat a much larger synthetic set, because they carry the distribution you actually serve. Every incident becomes a permanent regression case. The set is a living asset, and it is the thing that makes model swaps safe.
LLM-as-judge scales, then quietly drifts from human judgment. Re-validate against human raters on a fixed cadence and track the agreement rate as a metric in its own right.
Injection through retrieved content, tool-parameter manipulation, memory poisoning, multi-turn goal drift, permission probing. Findings become regression cases, and the cadence rises with the tier.
Numbers agreed with the business, in the agent card, checked in the pipeline. A subjective "seems better" is not a release criterion anyone can defend after an incident.
Sample live runs, score them, watch the trend. Offline evals catch regressions you thought of. Production sampling catches the ones you did not.
Cost per successful task, tokens per task, steps per task, p95 latency. An agent that becomes twice as expensive for the same output has regressed even if accuracy held.
Run the new version alongside the current one on live traffic without acting on its output. Compare trajectories. This is the cheapest confidence you will ever buy.
A named person, recorded in the registry before the agent ships. Accountability cannot sit with a committee, a platform or the model vendor. The architecture's job is to make that accountability workable: give the owner visibility, controls and a stop button that functions.
Registered identity, accountable human, defined purpose, expiry date. Orphaned agents are detected and disabled automatically when their owner changes role or leaves.
Policy that lives in a document is a suggestion. Policy compiled into the gateway is a control. If a rule cannot be expressed as code, rewrite the rule until it can.
Uniform review for every agent teaches teams to route around governance. Light-touch self-service at R0 and R1, real scrutiny at R3 and R4. Speed at the bottom buys rigour at the top.
Maintain one control set and map it to ISO/IEC 42001, the NIST AI RMF and EU AI Act articles. Auditors get evidence from the same pipeline that runs the platform.
Append-only, tamper-evident, retained to the regulatory horizon, queryable by agent, user, tool and time. If the log write fails, the action fails.
Run the drill: an agent takes a wrong action at scale. Who notices, how fast, who stops it, how is it reversed, who tells the customer. Practice this before you need it.
Any agent influencing an outcome for a customer or an employee gets outcome monitoring across relevant segments, with a documented review cycle and a route to challenge.
Permissions, tier, evals and business justification reviewed on a cadence you set from the risk class, and always when a tool or data source is added. Agents accumulate scope quietly. The review is what removes it.
Use the language of delegation. Everyone already understands giving a new colleague limited authority, checking their work, widening the remit as trust builds, and removing access when they move on. That framing carries an executive conversation further than any architecture diagram.
One page in plain language: what it does, what it may touch, what it cannot do, who owns it, how it is evaluated, how to stop it. This is the artifact that makes governance legible to non-engineers.
Tasks completed without intervention, cost per outcome, approval rate, incidents, hours returned. Token counts and model names belong in the appendix.
Involving them at the release gate turns them into an obstacle. Involving them at design turns them into a control requirement you can build. The second is faster.
When an agent takes a task, someone's job changes. Say which task, say what the person does instead, say who retrains them. Silence on this is what stalls adoption.
Model routing, coordination pattern, memory strategy, autonomy tier. Short, dated, with the alternatives and the reason. It is the cheapest way to keep a program coherent across teams.
A single view of every agent, its tier, its owner, its cost and its value. Retire the ones that are not earning. Agent sprawl is the next generation of application sprawl.
Every agent gets an expiry date and a retirement path: who is told, what replaces it, where its evidence is archived, how its permissions are revoked.
Give the current eval pass rate and the intervention rate before go-live. Stakeholders handle a known 92% far better than a discovered one.
Make the governed path the easy path. If using the platform is faster than building around it, adoption takes care of itself. Every control you ship should arrive with the scaffolding that satisfies it, so compliance is a side effect of using the template.
A repository template with the gateway client, tracing, eval harness, prompt registry, agent card and CI gates already wired. Day one to first governed agent should be measured in hours.
Same gateway, same policies, same traces, sandboxed data. Debugging an agent against a different stack than it will run on wastes more time than any other single thing.
A trace viewer that shows the plan, each step, the context sent, the tool result and the policy decision. Teams that can see the run fix problems in minutes instead of days.
Eval thresholds, policy tests, prompt-injection suite, cost regression, tool contract tests. A failing gate blocks the merge. Nobody has to remember the checklist.
Assistants that write code and open pull requests need scoped repository access, sandboxed execution, mandatory human review and provenance on generated code. Same rules, same registry.
An internal skill catalog, office hours, a channel where teams post traces and get help. Reusable skills that others have certified spread faster than any mandate.
Time to first governed agent, share of agents on the golden path, gate pass rate, how often teams build around the platform. That last number tells you where the platform is failing.
Pair reviews, rotating design authority, a shared decision log. The scarce resource in an agent program is people who can reason about autonomy, and that is built deliberately.
If you are standing up an agent platform, tightening the controls on one you already have, or preparing for an audit that now includes agents, I am happy to look at it with you.
Tell me where you are with agents and what you are trying to make safe. I reply to every enquiry within two business days.
