The difference between a demo agent and a production agent isn't the model. It's the guardrails. Here are the five we require before any Greyflows agent goes live — each one exists because a system without it failed in an interesting way.
1. Scoped tools, least privilege
The agent gets its own API credentials — never a human's. Each credential can read what the agent needs to read and write where the agent is allowed to write. If the agent's job is triage, it can update ticket status; it cannot delete tickets, export the customer list, or email the CFO.
The failure story: an early agent we inherited had a blanket CRM token and a fondness for "cleaning up" duplicate contacts. It merged two enterprise accounts. Scoped tokens would have made that merge impossible instead of embarrassing.
2. An eval suite that runs on every prompt change
Before an agent ships, we write 30–100 test cases drawn from real history: the obvious ones, the weird ones, the adversarial ones, the ones with typos and mixed languages. The suite runs on every prompt or model change, and a regression blocks the deploy.
Eval pass rate at launch on our support triage agent: 97.4%. Without the suite, that number is vibes.
3. Confidence escalation, not silence
The agent must know what it doesn't know. Every task gets a confidence signal — a classifier score, self-assessment, or a simple "did the rules match" check. Below threshold, it stops and hands to a human with the full context attached. The escalation path is the product; the model is just the router.
4. Audit logs a human can read
Every agent decision is logged: input, classification, action taken, confidence, escalation reason. Not a JSON blob in a console — a timeline a support lead can read when a customer asks "why did the bot say that?". This is also what keeps eval suites honest: failures logged today become test cases tomorrow.
5. Spend and blast-radius caps
Token budgets per task, per day, per customer. A runt loop retrying a malformed payload shouldn't turn into a four-figure invoice. And any action that moves money, deletes data or contacts a human gets a hard approval gate the model cannot talk its way past — the check happens in code, not in the prompt.
The uncomfortable summary
All five guardrails are boring engineering. None of them involve the model. That's the point: agents fail like distributed systems fail, and you make them production-safe the same way — scoping, monitoring, escalation and limits. If you're considering an agent and want the guardrail review done for you, start with the audit.
Want this in your stack instead of your reading list? Start a project →