Field Note 001 · July 2026
Useful AI agents need boundaries, not just better prompts
The difference between an impressive demo and a useful operating system is usually permission, evidence, and a clear place for human judgment.
A prompt can make a model sound smart. It cannot, by itself, make a system trustworthy. The moment an agent can read company data, update a workflow, contact someone, or spend money, the design problem changes. The question is no longer “What should the model say?” It becomes “What is this system allowed to know, decide, and do?”
That is why I think about agents as operating roles rather than chat windows. A useful role has a defined responsibility, approved sources, specific tools, and an escalation path. It also has things it is explicitly prohibited from doing.
A useful agent is not the one with the longest prompt. It is the one whose authority is easiest to understand.
Start with the decision boundary
Before choosing a model or writing instructions, identify the decisions in the workflow. Which are reversible? Which create financial, reputational, or privacy risk? Which require context that only a person has?
Low-risk collection and transformation work can often be automated. Recommendations can be drafted with citations. Sensitive outreach, publication, budget changes, and destructive actions should stop at an approval point. The boundary is part of the product, not an inconvenience added after the demo.
Evidence should travel with the answer
An agent that produces a conclusion without showing where it came from forces the operator to repeat the research. A better workflow carries the source, the relevant excerpt or record, and the confidence limitation into the output.
This matters especially when the source systems disagree. Good automation should make uncertainty visible instead of quietly choosing the most convenient number.
Design for failure while the system is small
Tools time out. APIs return partial data. Documents move. Models make plausible mistakes. A real agent architecture needs retry rules, verification steps, and a safe fallback that tells the operator what did not happen.
The best result is not maximum autonomy. It is useful leverage with clear accountability. When an agent can explain its source, its limits, and the next required human decision, it starts to become part of an operating system.