The hard part of shipping agents to production is not reasoning quality. It is the permission model, the audit trail, and knowing when to stop.
Every agent demo looks the same and works the same. Every agent in production differs on the same three axes: what it is allowed to touch, what evidence it leaves behind, and what it does when it is unsure.
Capabilities are an allowlist
Give an agent a typed tool per capability, each with scoped credentials, rate limits, and an explicit reversibility classification. Reversible actions can run autonomously. Irreversible ones — refunds, deletions, external communication at scale — require approval until evaluation data earns them autonomy.
This is not a limitation on capability. It is the mechanism by which capability expands safely.
Audit trails are the product
When a stakeholder asks why the system did something in March, the answer must be retrievable in seconds. That means persisting the inputs, the retrieved context with source references, the tool calls with arguments and results, and the decision at every gate.
Teams that treat this as observability overhead ship slower, because every incident becomes an investigation instead of a lookup.
Evaluation is a CI gate, not a launch checklist
Build a golden set from real cases, including the ones that went badly. Run it on every prompt, model, or retrieval change, in CI, with a threshold that blocks merge. Sample production conversations weekly and promote the interesting failures into the set.
Without this loop, a model upgrade is a coin flip. With it, it is a pull request.
Knowing when to stop
Confidence-based escalation is the highest-leverage feature in an agent system. An agent that hands off cleanly with full context is more valuable than one that resolves five percent more cases and occasionally invents an answer. Users forgive handoffs. They do not forgive confident errors.