01 · The span of model-directed controlBegin after authority is real; end before it becomes implied

Agentic territory starts where a bounded goal requires runtime choices among paths, evidence or tools. It stops where commitment demands authority or proof the agent cannot safely supply.

The surrounding workflow does essential work. Before entry, deterministic services authenticate the principal, admit an eligible case, assemble authoritative state, enforce permissions and set budgets. Inside the span, a model may retrieve, interpret, plan, call approved tools, observe results and revise. At exit, another boundary validates the evidence, records uncertainty, assigns unresolved work and hands the result to an authorised person or deterministic service. A consequential action occurs only after a commitment gate.

This means an agent may investigate without deciding, draft without sending, reconcile without posting, or propose a plan without reserving resources. In a low-consequence and reversible domain it may act, but the operation, object, amount, recipient and rate remain externally constrained. Breadth is not a virtue by itself. The business case is the value of runtime path choice minus added uncertainty, latency, cost, permission surface and recovery burden.

Thought experiment: the same capable model, two spans

In the first design, an agent receives a credit request, retrieves any source, chooses a policy, calculates exposure, recommends terms and updates the account. In the second, deterministic intake fixes identity, eligible products, governing policy and authoritative evidence. The agent investigates anomalies and produces a cited pack. A credit officer decides; deterministic closure writes one atomic transaction. Model capability is identical. The second design is easier to verify because runtime latitude is concentrated where interpretation adds value and removed where authority matters.

The negative control

Encode the complete path as ordinary software when the rules, sequence and exceptions are stable. If the deterministic version meets the outcome with lower cost and clearer recovery, the agentic span should be zero. Calling a fixed prompt chain an agent does not create adaptive value. The Runtime Agency Necessity Test must show that useful progress depends on evidence interpretation, runtime tool selection or plan revision after intermediate results.

02 · Agentic Boundary ArchitectureTen layers turn an agent into a governed control span

Planning freedom and action freedom are separate. A workflow can allow broad investigation while retaining every consequential commitment.

The architecture begins with deterministic intake and authoritative state. Agent entry packages a goal, context, tools, budgets, policy and stop conditions. Runtime agency plans and observes within a control envelope. Observation and challenge produce traces, receipts, tests, uncertainty and human intervention. Agent exit names completion, partial progress, abstention, timeout, conflict or failure.

The commitment boundary then decides whether validated output can influence a decision, communication or transaction. Deterministic closure applies an atomic action, updates the record, receives acknowledgement and reconciles side effects. Lifecycle control monitors change, breach, recovery, suspension and retirement. None of these layers can be replaced by a sentence in the prompt because hard permissions, budgets and state transitions must be enforced outside the model.

03 · Agent Entry ContractA request is not an authority grant

The entry controller compiles identity, goal, evidence, permissions, budgets and stop rules into a runtime capsule before the first model-directed choice.

Specify the trigger and eligible case population, authenticated principal and delegated identity, completion condition and non-goals. Attach an authoritative evidence manifest with provenance, freshness and unresolved conditions. Register permitted tools by operation, object, parameter, environment and recipient. Set time, step, token, spend, volume and rate budgets. State the maximum reversible effect, escalation rules, logging, timeout, kill switch, fallback, incident route, owner, expiry and reauthorisation trigger.

The capsule has two audiences. Machines need enforceable claims: identity tokens, resource limits, schemas and permission predicates. People need a legible explanation of what the agent may attempt, which decisions remain outside, and what happens on incomplete work. A prompt can guide behaviour, but it cannot be the sole mechanism for access control, transaction limits or budget termination.

Entry must survive stale and hostile context

An approved source can still contain prompt injection, stale state or material outside the case. The entry contract separates permission to read from authority to obey. Retrieved content is evidence, not instruction. The agent cannot expand credentials because a document asks it to, infer consent from a conversation, or treat a tool description as policy. Any requested scope change returns to an external authority service and, when material, reauthorisation.

Authoritative state is a service, not a context dump

Entry should assemble the smallest sufficient, versioned view of the case rather than pour every available record into a prompt. That view identifies which system owns each fact, when it was observed, which conditions remain unresolved and how long the snapshot is valid. A credit agent, for example, may receive the current application, verified identity, declared policy version and approved data sources. It should not receive an old analyst note as if it were present truth, or a free-text field as if it could amend policy. Keeping evidence, instruction and authority distinct makes provenance inspectable and prevents accidental privilege from arriving through context.

Freshness also needs an enforceable rule. If a relevant record changes while the agent is working, a lease or version check can invalidate the run before its recommendation crosses the exit gate. Closed cases, revoked consent and changed permissions should terminate or rebuild the entry package rather than rely on the model to notice a contradiction. This is where a deterministic precondition check earns its place: it confirms that the case still exists, the requesting identity still has standing and the authorised purpose still applies. The agent begins only after those facts are true, and it never becomes their source of truth.

04 · Runtime Agency Necessity TestKeep known paths out of the loop

Agency is justified when adaptive choice is necessary and independently verifiable, not when a model can imitate a fixed sequence.

Ask whether the path is stable enough for deterministic orchestration; whether unstructured or changing evidence requires interpretation; whether the system must choose tools at runtime; and whether progress depends on revising a plan after intermediate results. Consider whether exception variety defeats a practical decision tree while remaining bounded enough to govern. Then test whether the exit state can be verified outside the agent and whether value exceeds added cost, latency, variability and failure surface.

An invoice workflow with explicit tolerances, complete data and a stable route should remain deterministic. A research investigation may justify iterative retrieval because the next source depends on what the last one reveals. A procurement task may justify adaptive discovery but not negotiation and commitment in the same loop. Several controlled stages can preserve runtime value without transferring end-to-end authority.

The test that prevents pseudo-agency

A chain of prompt templates follows a known path: classify, extract, summarise and format. The fact that each step calls a model does not make workflow control agentic. Ordinary orchestration can own the sequence, validate every transition and retry safely. Calling it an agent obscures the simpler control model and may encourage broader tools or permissions without any adaptive need.

05 · Bounded Autonomy EnvelopeGrant ten latitudes independently

“Semi-autonomous” hides the decision. Specify what may vary across goal, evidence, planning, tools, parameters, state, communication, resources, time and delegation.

Goal latitude may be a fixed task or bounded objective, not an open mission. Evidence latitude may permit approved retrieval while excluding broad discovery. Planning can select among templates or dynamically decompose. Tool access can be a fixed call, an approved subset or runtime choice. Parameters can be exact or constrained. State can be read-only, proposed, reversibly written or consequentially committed. Communication can remain an internal draft. Resource and time budgets can be fixed or metered. Delegation can be prohibited or limited to predefined subtasks.

06 · Commitment Surface MapEnd agency before consequence crosses authority

A commitment surface is any point where a proposal becomes a decision, transaction, authoritative record, external message, permission change, production effect or costly downstream burden.

For each surface, record the actor, object, operation, precondition, evidence, consequence, reversibility, approval, atomicity, receipt, monitoring and recovery. The default is to end the agent before the surface. A narrow exception is reasonable when the action is low consequence, reversible, explicitly authorised and externally enforced.

A customer-support agent might issue a small credit within a fixed amount, product, account and rate envelope. The transaction service checks eligibility and idempotency, writes atomically, returns a receipt and supports reversal. The agent does not infer its limit from model confidence. It submits a proposed operation to a gate that owns authority.

A broad procurement agent becomes three stages

Discovery can adaptively search approved sources and build a candidate set. Comparison can analyse evidence against declared criteria and produce a cited recommendation. Negotiation and commitment sit behind separate authority and communication boundaries. Splitting the broad loop preserves useful exploration while preventing evidence collection from silently acquiring the right to bind the organisation.

Atomicity changes where agency must end

Some operations look reversible in the interface but are not atomic in the underlying service. A timeout after a payment request, message send or inventory reservation may mean that nothing happened, that the action completed, or that a retry would duplicate it. The agent should therefore stop before an ambiguous commitment unless the surrounding system provides idempotency, a durable operation identifier and a way to read the authoritative result. A reservation can sometimes sit inside the envelope when it expires automatically and is explicitly reconciled. A final capture, external communication or legal acceptance usually belongs after the exit gate.

This distinction prevents a fluent loop from inventing exactly-once behaviour that the service cannot guarantee. The controller records the request before dispatch, treats uncertainty as a separate state, checks the destination before any retry and routes unresolved effects to a recovery owner. Compensation is not the same as reversal: refunding a payment cannot unsend a disclosure or erase a market order. Commitment boundaries should reflect the real consequence, not the label on the tool call.

07 · Agent Exit and Handoff ContractTurn a trajectory into an acceptable state

Exit can be complete, partial, abstain, escalate, timeout, budget exhaustion, conflict, failure or cancellation. Every type needs a receiving rule.

The handoff includes an output schema, evidence manifest, claims, sources, transformations, uncertainty, tools called, state read, state proposed and side effects already created. It lists tests and policy checks, the receiving person or service, remaining decisions, validity period, retry and idempotency treatment, authoritative record, acknowledgement, rollback, retention and deletion.

The receiving workflow must accept, reject or route the package. A reviewer who sees only the agent’s narrative cannot independently challenge it. A final answer is not a receipt, and a tool success code is not proof that the intended business outcome occurred. Deterministic closure checks the state change and downstream acknowledgement.

Thought experiment: the perfect answer with no receipt

Imagine an agent that analyses every source correctly, applies policy exactly and tells a customer that a payment has been posted. Its call to the payment service timed out after dispatch. The model's reasoning is flawless, but the ledger shows no confirmed transaction and the recipient has not acknowledged anything. Is the workflow complete? It cannot be. The polished answer describes an intended outcome, while the business state remains unknown. If the system simply retries, it may create a duplicate; if it closes the case, it may abandon a failed payment; if it assures the customer, it has converted uncertainty into a false commitment.

Now place the same agent behind an exit contract. It returns the proposed amount, policy evidence, operation identifier, ambiguous dispatch state and prohibition on a blind retry. A deterministic receiver queries the ledger, obtains either a durable receipt or a confirmed absence, and then commits, safely retries or escalates. The reasoning quality has not changed. The boundary has changed what the organisation is willing to call complete. This thought experiment exposes a central design rule: completion belongs to the receiving state machine, not to the component that produced the most persuasive narrative.

Handoff capacity is part of the end boundary

A named receiver is meaningful only if it can accept the volume and reconstruct the case without repeating the agent's work. Queue limits, response targets, specialist coverage and evidence access are therefore boundary properties. Sending every uncertainty to an unstaffed review queue does not reduce risk; it relocates delay and invites rubber stamping. The contract should specify what the receiver can decide, what context it sees, how ageing changes priority and when an unattended handoff becomes a controlled failure. In high-consequence work, measured reviewer capacity can be the factor that sets the safe upper limit on agent throughput.

08 · Termination and boundary creepThe surrounding system decides whether progress continues

An agent cannot be the sole judge that it is advancing. Hard budgets, repetition tests and kill switches belong outside the loop.

The Loop Termination and Progress Contract sets permitted steps and tools, time, spend, token and action budgets, and a progress measure tied to the goal state. It detects repeated states, oscillation, no new evidence and diminishing returns. It routes conflicting sources, unresolved dependencies, retries and backoff. On termination it produces a safe partial result, cleans temporary state and assigns the next action.

Boundary creep occurs when the agent accepts new cases, retrieves broader context, calls new operations, retains longer memory, converts advice into action, contacts new recipients, delegates authority or changes downstream work. Such expansion may be valuable, but it is a new design decision. Better model performance does not itself justify wider permission.

The research loop that stopped learning

A research agent continues calling sources but adds no new evidence. The progress contract detects repeated claims, diminishing returns and an unresolved dependency. At the step budget it exits partially with sources inspected, contradictions, missing evidence and the exact question requiring human or external resolution. It does not manufacture certainty merely to produce a completion.

Prompt injection at the tool boundary

A retrieved page instructs the agent to request broader credentials and send data elsewhere. The content is evidence, not authority. The external policy engine rejects the operation, records the attempted scope change, terminates the run and routes a security incident. Prompt guidance helped the agent recognise the risk; scoped credentials and independent enforcement prevented the effect.

The strongest rival: narrowness can destroy agency

An agent forced to stop at every handoff may offer no advantage over a fixed workflow. Some domains create value precisely because the agent pursues a long-running objective, calls many tools, recovers from errors and acts without synchronous approval. Deterministic wrappers can become rigid and expensive. Human approval can turn ceremonial and introduce automation bias.

The answer is not universal narrowness. Envelope breadth should follow evidence, consequence, reversibility, independent verification and recovery. Longer loops and reversible action can be sensible. Move oversight to design, sampling or exception review when per-action approval adds no decision value. Expand one latitude at a time from observed operating evidence rather than granting an undefined mission.

09 · Ten named casesThe correct agentic span changes with consequence

These cases exercise deterministic, investigation-only, narrow reversible-action, staged and stop routes.

10 · Agentic Workflow Boundary DesignerPlace runtime choice between enforceable rails

Set the evidence conditions or load a case. The instrument chooses a boundary pattern, not an autonomy score or vendor.

Use the result as a boundary hypothesis

Complete the entry, envelope, commitment, exit and termination contracts before treating the route as authorised. A positive result permits a span to be tested on representative ordinary, peak, adversarial, tool-failure and recovery cases. It does not grant production access. A deterministic result avoids agency where runtime choice adds no value. A staged result divides incompatible goals or commitment surfaces. A stop result means the surrounding system cannot currently enforce a safe end.

11 · Boundary Assurance DocketExpand one latitude at a time, or suspend

The docket makes the boundary a versioned operating decision with evidence, owners and a route to shrink.

Record the business outcome, population and agentic-value claim; deterministic workflow before and after the span; necessity findings; entry contract; all autonomy dimensions; enforcement; commitment surfaces; exit and handoff; termination; ordinary, adversarial and recovery evidence; affected-party routes; cost and latency; alternative architecture; residual risk; monitoring, suspension and reauthorisation. The Agent Boundary Panel then displays entry validity, active permissions, tool trace, budget, progress, surfaces, exit state, receiving owner, side effects, incidents and changes without collapsing them into a score.

Apply the Agent Boundary Reauthorisation Rule when the goal, case population, context, evidence, model, prompt, memory, tool, operation, parameter, identity, permission, action, recipient, budget, loop, human role, commitment surface, workflow, vendor, law or affected population changes materially. An unauthorised action, prompt injection, repeated loop, unacknowledged handoff, duplicate effect, human bypass or recovery failure triggers suspension first, investigation second and a new decision before restart.

Long-running agency needs narrower inheritance

A long-running operations agent may delegate to specialised agents, but authority cannot pass transitively. Each child receives its own identity, task, sources, tools, budget, output schema and expiry. The parent can integrate results but cannot expand a child’s commitment right. This design permits deep adaptive work while keeping permission provenance inspectable and termination possible.

Where useful agency stops

The end boundary is not synonymous with a human click. It is the point before an effect that the agent lacks evidence or authority to commit. Sometimes that effect is safely inside the envelope; often it is a decision, message or transaction accepted by another actor. What matters is that the workflow can name the object, operation, consequence, receipt and recovery.

A useful agent is defined as much by where its control stops as by what it can do. The changed design rule is direct: make entry deterministic, make runtime latitude explicit, make commitment separately authoritative and make every exit receiptable. That is how an organisation gains adaptive path selection without allowing capability to manufacture permission.