Agents: when to let the system act on its own
When it's justified
When the number of steps isn't known in advance. A fixed process implemented as an agent is an expensive, unpredictable system where a simple loop would work. An agent suits investigation: “find why the invoice doesn't match.”
Three levels of autonomy
Proposes for human approval; acts alone on reversible actions and routes irreversible ones for approval; and autonomous in a defined domain with a proven track record. The distinction between reversible and irreversible is the central design decision.
What must exist before connecting permissions
Minimal permissions; hard limits in code on step count, cost and time; a full action log; and complete separation between external content and instructions.
And a practical rule: fewer tools, well defined. The more tools there are, the worse the choice among them.
Going deeper
Define each tool like a public interface: an explicit name, when to use it and when not, a strict schema, and errors that explain what to fix. Make sensitive actions two-step — preparation and confirmation — and run scenarios designed to fail it, including malicious input, before going live.