AI · 2026-06-02 · 8 min
AI agents need allow-lists, not personalities
Production agents should have one job, a tool list, and an escalation path. Open-ended “do my work” agents belong in a sandbox.
Demo videos love agents that book flights, rewrite strategy decks, and joke with the user. Production environments love agents that do one thing: look up a contact, draft a reply from a knowledge base, or open a deal in the right pipeline.
An agent is a loop with tools. Every tool is a privilege. “Send email” is not a toy; it is deliverability and legal risk. “Update CRM” can destroy reporting. We implement allow-lists: this agent may call these endpoints with these argument shapes. Everything else is a 403.
Traces are how operations learns to trust the loop. If you cannot see which passage was retrieved and which API was called, you cannot debug a bad send. Logging is part of the product.
Human-in-the-loop is a design choice, not a cop-out. High-risk actions (refunds, medical, legal, public posts) wait for approval. Low-risk actions (tagging, summarising, internal drafts) can run. Mix them honestly.
The useful offer is still AI agents that handle repetitive tasks so people can do strategic work. The implementation has to be strict: one job, one success definition, one escalation path. If you need a general assistant, start with RAG chat. Graduate to tools when the questions turn into actions.