An AI agent is easy to demonstrate: give a model a goal, connect tools and let it iterate. Production changes the question. The system must know which identity it acts for, what it may change, how it recovers and who remains accountable.

A production AI agent is a bounded software system in which a model selects steps and tools inside explicit permissions, budgets, evaluation and human decision rights.

Architecture should reduce the uncertainty introduced by model reasoning. The best design is rarely the agent with the most tools. It is the smallest agent that reliably completes a valuable job.

Define one role and outcome

Give the agent a narrow responsibility such as researching approved sources, triaging an enquiry or preparing a reconciliation package. State the completion condition and conditions that require refusal or escalation.

Avoid a universal “company agent.” Broad roles create ambiguous permissions and evaluation. Several bounded workflows are easier to secure and improve.

Map the current human workflow before automating. Preserve controls that exist for a reason.

Separate reasoning from action

Let the model interpret language and propose steps. Put authorization, validation, calculations and state changes in deterministic services.

Use an allow-listed tool registry with typed inputs. Validate every argument outside the model. Apply the requesting user’s permissions at execution time; the agent should never gain the combined access of all connected systems.

Require confirmation for external communication, financial change, access control and other high-consequence actions. Make drafts and completed actions visually distinct.

Manage state explicitly

Store task state, decisions, tool results and approvals in a durable workflow layer rather than relying on model context as memory. Use unique identifiers and idempotency so retries do not repeat an irreversible action.

Limit retained conversational history. Summarisation can reduce cost but may lose material detail, so retain authoritative structured state separately.

Define what can be remembered across users or sessions and apply privacy and deletion rules.

Design for failure

Set time, step and spend budgets. Add timeouts, retry limits and circuit breakers around model and tool dependencies. Make a partial result explicit rather than presenting it as complete.

Provide a cancellation path and a safe queue for human takeover. Version prompts, models and tools so an incident can be reproduced and rolled back.

The OWASP Top 10 for LLM Applications highlights prompt injection and excessive agency. Architectural limits are stronger than asking the model to defend itself.

Evaluate the trajectory

Test whether the agent selected the right tool, used valid arguments, respected permissions, handled tool failure and stopped appropriately. Final-answer quality alone can hide a dangerous path.

Build scenarios from real work plus malicious inputs, missing data, conflicting evidence and degraded services. Measure successful outcomes, unnecessary steps, human intervention, severe failures, latency and cost.

Compare new versions against a stable regression set before release.

Observe without collecting everything

Trace task, model, prompt, retrieval and tool versions. Log decisions and errors with data minimisation. Monitor loops, denied actions, unusual retrieval, cost spikes and correction patterns.

Give an operating owner a dashboard tied to the business outcome. A graph of tokens consumed does not show whether the agent helped.

Agentra is Vinove’s AI company for real business work, supported by ValueCoders for the surrounding engineering. Both follow the Vinove standard: useful after launch, not merely impressive during it.

Production readiness

Confirm a bounded role, least-privilege tools, external validation, durable state, idempotent actions, human approval, failure budgets, trajectory evaluation, observable versions and an accountable owner.

Agents create value when they handle ambiguity that deterministic software cannot easily absorb. Production architecture earns that flexibility by keeping authority, evidence and recovery outside the model’s improvisation.

Example: a controlled research agent

A market-research agent can search approved sources, extract claims and prepare a cited brief. It receives no email, CRM write or publishing permission. The orchestrator limits source domains, steps, time and spend. Each claim must carry a source passage and date.

If evidence conflicts, the agent marks the issue instead of resolving it through confidence. A person reviews the brief, opens material sources and decides what can be used. The production trace records source, model and prompt version without retaining unnecessary personal data.

This narrow architecture creates useful leverage while keeping the agent’s authority low. If future evidence supports automatic filing into a research library, that permission can be added separately. Capability grows through measured trust rather than a large initial tool set.