Agents Honestly
Appendices

Decision Tables

Every "which one should I use" question in the book, collected as one reference.

Every table here appears in a chapter with the reasoning attached. This page is the lookup: the question, the answer, and the link to why.

Read it as a checklist when starting something, or as a differential when something is wrong.

Architecture

Should this process become an agent? Process discovery and value

What you foundDecision
Nobody owns the outcome or can define successDo not automate it yet. Establish ownership and a baseline first
The process exists mainly because two systems do not integrateFix the integration or process before adding a model
Rules cover the decision and exceptions are enumerableFunction or workflow
Judgment is needed, but actions can be enumeratedModel at the judgment point inside a workflow
The next useful action depends on evidence discovered during executionAgent, with an authority ceiling and exit criteria

Should this be an agent at all?

IfBuild
The steps are known in advanceA workflow. Model calls at the judgment steps only
The next action requires having seen what the last one returnedAn agent loop. Varied content is not this test
You can enumerate the operationsEnumerate them. Do not add run_python
It is a single classification or extractionOne structured call, no loop

What tier of architecture? Reference architecture

Run outlives a request?Visible side effects?Build
NoNoTier 1, web app plus a model client
NoYesTier 2, plus a dispatcher and idempotency
YesNoTier 2, queue plus a state table
YesYesTier 3, durable execution

One agent or several? When not to

Reason givenVerdict
Context genuinely exceeds a window after compaction and selective retrievalSplit, isolation
A component must be denied tools or data another holdsSplit, trust boundary
Two teams deploy and are paged independentlySplit, ownership
"Specialist agents perform better"A system prompt. Don't split
"It mirrors our org"Conway's law. Don't split
"It parallelizes"True only for disjoint items, that is map-reduce, not conversation
You cannot yet state the handoff contract and termination conditionNot yet

Supervisor or handoff? Supervisor and handoff

SupervisorHandoff
Use whenWork decomposes; parallel searchOwnership is genuinely separate
Fails byIts context is the ceiling; the plan is fixed at maximum ignoranceNobody owns termination; context evaporates per hop
DefaultYesOnly with a coordinator of last resort

Function, MCP, A2A, or durable workflow? MCP Is Not A2A

BoundaryUse
Same codebase and deploymentA function or typed internal API
A client needs to discover and invoke remote tools or read resourcesMCP
One independently operated agent delegates a task to another and observes its lifecycleA2A
Your system owns a long-lived business process that must survive failures and waitsA durable workflow, not an agent protocol
A remote agent needs access to a tool exposed by another serviceA2A for delegation; MCP for the tool boundary. Do not collapse the identities or lifecycles

Context and retrieval

Where does the answer live? Part IV

The question isRoute to
"What does the policy say about X"Semantic search over documents
"How much / how many / total by"SQL. Not a vector index
"Why is this account at risk"Graph traversal
"Where is order 4921 right now"Live API
"What did the customer say last Tuesday"The conversation store

Which context technique? Part III

ProblemTechnique
Window fills over a long runCompaction at a checkpoint, not edge-trimming
The same payload is re-sent every turnSummarize to the fields used; pointers over payloads
Cache keeps missingStable prefix, nothing before the breakpoint moves
A subtask is noisySub-agent isolation
The model reasons from its own wrong numberTyped scratchpad, only tool-returned values
You need it to survive compactionThe scratchpad, not the transcript

Which retrieval refinement?

SymptomFix
Right document, wrong chunkParent–child chunks
Exact IDs and codes never matchLexical search alongside semantic
Top-5 is noisy but top-50 contains itTwo-stage rerank
Conversational phrasing retrieves poorlyQuery rewriting
Stale answers on time-sensitive questionsFreshness routing
Cross-account leakageFiltered retrieval, and prefer separate indexes

Tools

Tool class, and what it obliges Part VIII

ClassExampleObligations
① Pure readget_orderNone. Retry and parallelize freely
② Observed readquery_warehouseDo not repeat unboundedly: it burns quota, starts clocks
③ Reversible writeescalate_to_humanYou own the undo
④ Irreversible writeissue_creditIdempotency key + paired read + compensation
⑤ External writesend_replyKey checked before sending; alone in its unit of work; paired read

Where does this value come from?

ValueSource
Tool argumentsThe model
Authority, identity, tenantYour code
Idempotency keyYour code, never the model
Amount on an irreversible writeRe-derived server-side from an ID
Recipient of an external sendThe record, not an argument
TaintThe fetcher, never the content

API, browser automation, or visual computer use? Computer-Using Agents

Available boundaryPrefer
Stable, authorized APIAPI tool
Web UI with semantic roles, labels, and a stable DOMBrowser automation with role or label locators
Remote desktop, canvas, legacy UI, or no programmatic surfaceVisual computer use in an isolated session
Source repository that must be inspected and changedCoding workspace with a pinned revision, path and command policy, external checks, and patch handoff
High-value irreversible actionA purpose-built API and approval gate, even if discovery happened through a UI
Any UI actionAssert the postcondition from authoritative state; a click is not proof of success

Reliability

Retry this? Error taxonomy

FailureRetryWhere
Connection reset, 5xx, overloadedYes, backoff + full jitterSDK only
429Yes, obey Retry-AfterSDK, with admission control behind it
Context length exceededNo, deterministicCompact and re-enter
Malformed tool argumentsNo transport retryReturn it to the model
Content refusalNoEscalate
Authorization deniedNoEscalate
Timeout on a writeNoPaired read first
Wrong answerMeaninglessEvals

Which timeout? Timeouts and retries

GuardTimeout
Endpoint unreachableConnect, seconds
Provider accepted and stalledTime to first token, tens of seconds
Stream died mid-flightInactivity, not total
The run as a wholeOne deadline, set at start, propagated

Which fallback rung? Fallbacks and breakers

RungAllowed for
1–2 Retry, alternate regionAll tiers, automatically
3 Reduce scopeAll tiers, prefer this to swapping models
4–5 Smaller model, other providerTier 0 only, and only if eval'd as its own variant
6 HumanAny tier, and the first choice above tier 0

Durability

Workflow or activity? Part XI

The codeGoes in
Decides, branches, orchestratesWorkflow
Finds something outActivity
Calls the modelAlways an activity
Calls a toolAlways an activity
Reads the clock, generates an IDThe SDK's replay-safe version
Waits days for a humanWorkflow timer + signal

Which durable runtime? Two Durable Runtimes

IfChoose
You deploy on Vercel, the agent is the product, TypeScript end to endVercel Workflow / WorkflowAgent
Waits run to weeks, retry behaviour is complex, the stack is polyglotTemporal
The agent is one process among many, and you need the history as an audit artifactTemporal
Your company already runs one of themThat one. It is not a per-project decision
Both are already in the buildingOne owns durability; the other is a library. Do not use WorkflowAgent

In-flight runs during a change Rollout

The change isRunning executions
A quality improvementFinish on the old bundle
A bug fixMigrate
A policy or authorization changeAlways re-evaluated at the moment of action

Human in the loop

What tier is this call? Risk tiers

Reversibility ↓ / Blast radius →One entity, smallMany, moderateWide, large
ReversibleTier 0, autonomousTier 1, notifyTier 2, inline approval
Costly to reverseTier 1Tier 2Tier 3, two people
IrreversibleTier 2Tier 3Tier 3

Blast radius is computed from the arguments, at call time, not from the tool.

Security

Which control for which threat? Part XVII

ThreatControlNot a control
Indirect prompt injectionCapability ceiling on tainted runsInput classifiers, delimiters
Corpus poisoningProvenance column + trust-split indexesOutlier detection
Over-scoped toolsArgument scoping; remove the parameterTool-level allowlists alone
Agent as superuserDelegation: sub = user, act = agentFiltering results after a privileged read
Cross-tenant leakageRow-level security; separate indexesWHERE in the query builder
Code executionMicroVM + broker + egress denyA container
Data exfiltrationRemove the egress vectorMonitoring for it
Erasure requestsA deletion registry + subject IDs on derived dataA DELETE on the main table

Is this a defense? One test: would it still hold against an adversary who gets unlimited attempts and knows it is there? If not, it is mitigation. Deploy it; do not grant capability because of it.

Governance

What evidence must exist at each lifecycle stage? AI Governance

StageMinimum evidence
ProposalIntended purpose, affected people, owner, baseline, expected value, prohibited uses
DesignData flow, authority contract, risk classification, human-oversight plan, supplier inventory
ReleaseEval results, security tests, approval, rollback plan, operator runbook
OperationVersioned traces, incidents, overrides, drift, cost, affected-user feedback
Material changeNew impact and risk review; do not inherit approval from the previous bundle
RetirementRevoked credentials, stopped workflows, deleted or retained data by policy, archived evidence, user migration

Use the NIST AI RMF Core and Playbook as primary references for the lifecycle controls. For legal dates and scope, consult the maintained European Commission AI Act implementation FAQ and qualified counsel.

Evals and operations

Which eval, for which question? Part XIV

QuestionInstrument
Did my change break something?CI suite on fixtures
Did my code change break something?Replay, deterministic
Did the model change under me?Frozen canary, on a schedule
Is it good on real traffic?Online scoring on a sample
Would this new policy fire wrongly?Shadow replay against recorded runs
Is a candidate prompt better?Shadow execution, then canary

Diagnosing a quality drop Drift

CanaryInputsDiagnosis
StableStableCheck the deploy timeline first, it is usually you
DroppedStableThe provider changed
StableMovedYour users changed: a new segment, phrasing, or season
StableStable, retrieval hit rate downThe corpus moved without touching the inputs. Check the last ingestion diff
StableStable, and still downAudit the memory store and the tool contracts

Which cost lever? Cost engineering

LeverLeverageQuality risk
Cut turnsSuperlinearNone
Shrink what's re-sent per turnLargeNone
Prompt cachingLarge on repeated prefixNone
Batch endpoints~half, latency-tolerant workNone
Model routing / cascadeLargeReal, the gate can be wrong
Cheaper model everywhereProportionalDegrades everything at once

The meta-table

Four questions recur across every table above, and if you only remember four things, remember these.

Who owns this state? Model, graph, workflow, or database. Most architectural mistakes are state at the wrong altitude.

Where does this value come from? If it grants authority, it comes from your code.

Would it hold against an adversary with unlimited attempts? If not, it is mitigation, not control.

What is the worst well-formed call on this path? That number is your blast radius, and it is the one you can change.


Next: Glossary, terms this field uses inconsistently, defined once.

On this page