Separate planning from acting
Let the model propose actions; execute only through a controlled tool layer with typed inputs and allow-lists. An agent that can “call any API” is an incident waiting for a prompt injection. Tools should be a short list: create ticket, fetch order, draft email—not a generic HTTP verb. Typed inputs mean the model cannot pass a string where an enum belongs. We integrate Gemini and other commercial LLMs behind that layer, chosen for cost, latency, and data residency, never as an unbounded brain with production credentials. RAG, if you have it, is another tool with citations—not a hidden side channel that bypasses ACLs.
Human-in-the-loop for irreversible steps
Refunds, emails to customers, and data deletes should require confirmation until trust is earned with metrics. Autonomy is a privilege you measure, not a launch-day default. Show the operator the proposed action, the retrieved context, and a confirm control. High-risk workflows (clinical, financial, legal) may never fully leave the loop; that is a product decision, not a failure of the model. We ship production AI with evaluation harnesses and token/latency budgets the same way we do RAG. Demos that skip the confirm step are not a production design.
Audit every tool call
Store who/what/when for agent actions. When something goes wrong, you need a timeline—not a mystery. Include the tool name, arguments, identity, and whether a human approved. Retention should match your policy; logging prompts that contain PII is its own privacy design. If you cannot reconstruct why a refund went out, you do not have an agent platform—you have a log-shaped hole. Incidents will happen. The audit is how you keep the second one from being worse.
Identity is not the model’s job
The agent acts as a user or a service account you define. It does not get a superuser “because it’s AI.” Row-level and tenant filters apply to tool implementations, not to a paragraph in the system prompt. Prompt injection will try to “ignore previous instructions.” Allow-lists and server-side auth are what hold; instructions are not. This is the same AuthZ rule as multi-tenant SaaS, applied to a new caller.
Evaluation for agents is different from RAG eval
Golden questions are not enough. You need scenarios: allowed action, blocked action, injection attempt, timeout, and human rejection. Run them when you change tools or prompts. Score false allows harder than false blocks. A blocked refund the human can still process is recoverable; an allowed refund to the wrong account is not. Put those cases in CI. We will not call an agent “production” without them.
How we take this work
Custom AI agents, document intelligence, and LLM workflows are a named service. We do not ship unbounded chatbots against your production data. Bring the workflow, the tools you are willing to expose, and the actions that must never run unsupervised. We will propose a tool layer, an approval matrix, and a range. If the brief is a widget that talks, we will say it is a demo. If it is an operator copilot with an audit trail, that is the engagement.
What production looks like after the demo dies
Operators see a proposed action, the retrieved context, and confirm. Irreversible tools stay behind that control until metrics say otherwise. Token and latency budgets are in the same dashboard as false-allow rate. Data residency for UAE, KSA, UK, and US buyers is a logging and vendor choice, not a system prompt. We integrate Gemini and other commercial models behind your tools—never with production credentials in the prompt. 100% IP on the application code, 90-day warranty, 2-hour response during the engagement. If you cannot list the tools, you do not have an agent brief yet; you have a chatbot brief, and we will price that smaller and more honestly.
