Running AI Agents in Production: An Operations Manual

§1Give every task a visible edge

"Fix the page" is a safe request between people and an unsafe instruction for an agent that can inspect files, call tools, and change external state. A bounded task answers five questions before execution: what outcome should become true, what is inside and outside the job, what the agent may do, what will count as evidence, and when it must stop.

Prompt polish cannot repair a missing decision boundary. The transformation that matters is not short prompt to long prompt — it is unbounded intent to a task with a visible edge.

§2The authority line

The most load-bearing rule in the whole system comes from the research fleet that proposes everything and executes nothing: an agent may freely perform any action it can also reverse. Everything beyond that ends at a recommendation with evidence attached, and a human carries it the last step.

This is not a training wheel; it is permanent architecture, and it follows from sizing autonomy by consequence rather than capability. The fleet in that dive is easily capable of executing — capability was never the question. In a domain where a wrong action is unrecoverable, the consequence an agent should carry for execution is none. Where enforcement cannot live in a platform setting, it lives in a governance file every session loads first, and in reviewers who treat it as law.

§3Verification is the product

"It looks right" is a first impression, not a test. The verification loop makes five moves: name the claim concretely enough to fail, establish the baseline before editing, test the narrow behaviour, scan the blast radius, and inspect the rendered result.

The claim that matters most is "done" — and completion is a stack of claims, each needing its own evidence:

A signal from one rung cannot stand in for the rungs above it. Agents overclaim not because they lie but because they answer the wrong question — "did my step finish?" instead of "did the user outcome become true?" The fix is an acceptance contract naming the required final observation before work begins. And verification starts before the first edit: prove which surface is live and which source produced it — an agent pointed at an older checkout will confidently optimise a version nobody uses.

§4Monitors that tell the truth

Production means watching things, and watching has its own failure modes. A quiet monitor collects broadly, preserves every observation with provenance, and interrupts only when a change crosses a decision threshold — with every source carrying an honest state, where unknown is never allowed to pass as unchanged. That one distinction prevents a broken collector from producing a false all-clear.

The subtler trap: a monitor can outlive its subject. An empty set satisfies almost any safety condition written about it, so absence and health produce identical output. Every monitor needs a liveness assertion about its own subject before any health assertion — and a subsystem's watchers belong in the same change that deletes it.

§5Memory that survives the session

Long-running agent work compresses reasons first: conclusions get copied forward while the observation that produced them falls away. Three artifacts prevent that.

A decision ledger records each rule as a supported claim, not a commandment — what to do, why it made sense, what later evidence said, and the trigger that should force a review. A handoff packet transfers work across a boundary by answering five questions in order: what is true, what was decided, what proves it, what must stop the work, and the safest useful action now — a transfer, not a summary. And when a decision must outlive every session that might quietly undo it, encode it as a test: translate the exact strings, routes, and counts into an assertion that turns a violation into a red build, while stating the gate's blind spot honestly — a gate matches patterns, not meaning.

§6Scaling from one agent to a fleet

Adding an agent does not add a unit of throughput. Safe parallelism begins at the ownership boundary: one bounded outcome and one owned surface per lane, isolated workspaces, shared surfaces treated as reserved infrastructure, and one deliberately serial integration path. Worktrees isolate bytes, not decisions — the coordination still has to be designed.

Two disciplines keep a fleet honest. Review crosses lanes — never let one agent grade its own homework; nothing lands because its author is confident, it lands because a different reviewer tried to break it and failed. And context stays minimal — each audience gets the minimum sufficient context for its job, which keeps private systems, credentials, and history out of public artifacts while the agent still has what the work needs.

§7Where to start

Not with a platform decision. Pick one recurring task, scope it with the five questions, run it with the agent proposing and a human executing, and keep the verification evidence — that evidence is what tells you whether to expand the boundary. The reusable templates on this site cover the verification checklist, the live-truth checklist, the routing card, and the handoff packet; the cookbook holds the copy-usable conventions behind them.

For UAE teams that want this method applied to one measured workflow with explicit controls and an honest go/no-go, that is exactly what the Verified AI Operations Sprint exists for — including "do not automate" as a valid completed outcome.

§8The questions people actually ask