AI agents: from promise to an accountable workflow

A practical agent has a mandate, context, a decision loop, tools, state, and a stopping rule. The mandate says what outcome is allowed. Context supplies instructions and evidence. The loop selects the next bounded step. Tools perform actions. State records what changed. The stopping rule ends work when the goal is met, risk rises, or evidence is missing.

A polished language response can hide weakness in any of these parts. The system may misunderstand the mandate, retrieve stale context, choose an irreversible tool, lose state, or continue after its authority ends. Evaluate the whole workflow rather than the model alone.

A valid file-writing credential authorizes an attempted write. It does not establish that the write succeeded, reached the intended file, or produced a correct result. A publication credential similarly authorizes a service to attempt a public-state change without proving that the article is accurate. Good design keeps authorization and technical capability separate from verification and gives the release controller only the evidence needed for an exact decision.

Least privilege narrows damage when reasoning fails. Read tools should not silently become write tools. A drafting agent should not hold a deployment credential. Consequential actions should have explicit targets, dry runs where possible, immutable receipts, and a rollback path.

Agents can optimize the wording of a goal while missing its purpose, follow malicious instructions hidden in retrieved material, repeat an action after losing state, treat tool output as proof, or make a locally sensible change that breaks a downstream system. None of these requires an obviously irrational model response.

Controls should match the failure. Untrusted content needs isolation from instructions. Repeatable actions need idempotency keys. Claims need source checks. Writes need target validation and recovery. Long workflows need durable checkpoints and fresh authorization at the moment a consequential action occurs.

NIST's AI Risk Management Framework offers a useful organizing pattern. Govern establishes ownership and policy. Map defines the use, affected people, context, and failure consequences. Measure tests performance and records uncertainty. Manage selects controls, monitors operation, and responds when the system departs from expectations.

For a small team, this can be one page rather than a department. Name the owner, list allowed tools, describe the worst plausible failure, choose a test, define a stop rule, and retain a record. Add complexity only where the consequence justifies it.