The interesting part of an AI agent is rarely the prompt. The hard part is deciding what it is allowed to do, what it should never do, and what happens when the world does not match the happy path.
A production agent needs boundaries before it needs more autonomy. Start with permissions. Give the worker only the systems and actions required for its job. Separate reading from writing. Separate drafting from sending. Separate reversible work from irreversible work.
Then design the fallback. Every important action needs an answer to three questions: what happens on timeout, what happens on bad data, and when does a person take over?
Finally, make the system observable. If you cannot reconstruct what the agent saw, decided, attempted, and changed, you do not have an operational system. You have a demo.
The objective is not maximum autonomy. It is dependable execution with clear ownership.

