An agent is more than a long prompt
A practical agent usually has a model, tools, state, policies and a control loop. The model chooses or proposes actions; the application validates what is allowed and records what happened.
Use least privilege
Give each tool the smallest permission set necessary. Reading a ticket does not imply permission to delete it. Separate reversible and irreversible actions and require approval for high-impact steps.
State needs a lifecycle
Decide what belongs to the current task, what may persist between sessions and what must expire. Persistent memory without provenance quickly becomes an invisible source of errors.
Budget latency and cost across the loop
Agents can call models and tools many times for one user task. Measure cost per completed task, retry rates, tool failures and time spent waiting. A cheap model call can still create an expensive agent loop.
Observe and evaluate trajectories
Store traces that explain which tools were called and why. Build evals around task completion, policy compliance and recovery from tool errors. Autonomy should increase only when the evidence supports it.