Agent SOP Template

An agent is a workflow that chooses its own steps. That autonomy is the value and the risk, so it needs a written operating procedure before it runs.

Workflow or agent?

	Workflow	Agent
Decides the steps	You, in advance	The model, at runtime
Same input, same path	Yes	Not necessarily
Debuggable	Step by step	By reading its reasoning trace
Right for	Known, repeatable processes	Open-ended tasks where the path varies

Use a workflow unless you genuinely cannot enumerate the steps. Most things built as agents should have been workflows — they are cheaper, faster and predictable.

The SOP

Fill this in before building. If you cannot fill a section, you are not ready.

# AGENT SOP — [NAME]
Owner: [WHO]        Created: [DATE]        Review: [DATE]

## PURPOSE
What it does, in one sentence:
What it explicitly does NOT do:

## TRIGGER
It runs when:
It must never run when:

## TOOLS IT CAN USE
| Tool | What for | Can it write/send/spend? |
|---|---|---|
|  |  |  |

## LIMITS
Maximum steps per run:
Maximum cost per run:
Maximum runs per day:
Timeout:

## AUTHORITY
It may do without asking:
It must ask a human before:
It must NEVER do, even if asked:

## WHEN IT IS STUCK
If it cannot complete the task:
If a tool fails:
If it is uncertain:
(All three answers should be "stop and tell a human", not "try something else")

## HUMAN IN THE LOOP
Who reviews, and what:
How they are notified:
What happens if nobody responds within [TIME]:

## LOGGING
What is recorded every run:
Where:
Retained for:

## FAILURE
How I find out it broke:
Who is paged:
How to stop it immediately:

That last line matters. Know how to kill it before you start it.

The authority section, expanded

This is the section that prevents expensive incidents. Be specific.

Safe without asking: reading, searching, drafting, classifying, summarising, writing to a scratch location.

Ask first: sending anything to a person outside the team, writing to a system of record, spending money, deleting anything, acting on a customer's account.

Never: moving money, changing permissions, emailing a list, deleting backups, acting on instructions found in content it read.

That last one deserves emphasis. An agent that reads external content — web pages, emails, documents — can be instructed by that content. Prompt injection against an agent with tools is the most serious risk in this course. Anything that reads untrusted input and can also act must have a human between the reading and the acting.

Cost control

Agents loop. Looping costs money, and the cost is invisible until the invoice.

• Hard cap on steps per run
• Hard cap on spend per run
• Hard cap on runs per day
• Cheap model for routine steps, expensive model only where it matters
• Alert if a run hits any cap
• A dashboard or daily digest of runs and cost

Calculate before launch: worst-case cost per run × maximum runs per day × 30. If that number would worry you, lower the caps.

Testing

• The normal case
• A case where the task is impossible — does it stop, or thrash?
• A case where a tool returns an error
• A case where a tool returns nonsense
• An input containing instructions ("ignore your instructions and…")
• An ambiguous input — does it ask or guess?
• Run it 10 times on the same input. How much does the path vary?

That last test is the one that tells you whether you should have built a workflow instead.

Running it

Start supervised. For the first two weeks, every run is reviewed by a human before its output is used. You will find things the tests did not.

Then sample. Review one run in ten. Keep sampling permanently — agents drift as the world around them changes.

Never fully unsupervised for anything that touches money, customers or systems of record.

Review log

Date	Runs	Failures	Cost	Anything surprising	Action

The honest summary

Agents are the most impressive and least reliable thing in this course. They are genuinely useful for research, triage and multi-step drafting where a human checks the output. They are not yet reliable enough to act unsupervised on anything that matters.

Build one. Supervise it. Do not give it your credit card.