Agents in production: 12 rules

So here's the thing. An AI agent is basically a loop, right? The model decides, calls a tool, looks at the result, and goes round again. In a demo, no problem at all. But in production? A loop with no limits can run for hours, call the wrong tool, and quietly burn through your budget. So, how do we keep it under control? Let's see.

Let me introduce you to the team that keeps an agent safe. First, the Agent. It does the actual work. Then the Interceptor, standing right in front of every tool call. The Budget Keeper counts steps, tokens and money. The Human Approver signs off on anything risky. And the Auditor? It writes everything down.

Rule number one. Always, always set a hard step limit. Every major framework has one. The OpenAI Agents SDK stops after ten turns by default. Google ADK allows five hundred model calls. CrewAI gives an agent twenty five iterations. And the Claude Agent SDK? No limit at all, unless you set one. So please, don't trust the default. Set your own, and handle the error when you hit it.

Rule two. Give every run a budget. A token budget, a cost budget, and a time budget. In the Claude Agent SDK, max_budget_usd covers the agent and all of its sub-agents, and once you hit it, no new sub-agents start. Now, leave a little headroom, because the reply that crosses the line still finishes. Add timeouts everywhere: on every model call, every tool, and the whole run. And rate limit how often anyone can start one.

Rule three, and this is the big one. Put a policy interceptor in front of every single tool call. Before the tool runs, it checks the call against your rules, and says allow, deny, or let's ask a human. Deny by default, and keep a short allow list. In the Claude Agent SDK, that's a PreToolUse hook. In Google ADK, it's a before tool callback. In the OpenAI Agents SDK, a tool guardrail. And remember, the real permission checks live in your own systems, not in the model's judgement.

Rule four: least privilege. Give each agent only the tools it actually needs, and avoid open-ended tools, like, run any shell command. Rule five: anything risky or irreversible, like moving money, deleting data, or emailing a customer, waits for a human. The run pauses, a person says yes or no, and if a rule can't be checked safely? The answer is simply no.

Rule six: watch out for loops. Sometimes an agent calls the same tool, with the same input, again and again and again. CrewAI actually spots this, and tells the agent to try something else. In other frameworks, just add that check to your interceptor. Rule seven: treat every tool result as untrusted. A web page or a file can hide instructions inside it. That's prompt injection. So run code in a sandbox with no network, and keep your secrets out of the model, and out of the sandbox.

Rule eight: be careful with multi-agent systems. Anthropic found they use about fifteen times more tokens than a normal chat. Fifteen times! They really shine when work splits into parallel pieces, like research, and they struggle when every agent needs the same context, like most coding. If you do use them, cap how deep agents can delegate, and how many run at once. Give each sub-agent its own small tool list, and share one budget across all of them. Fun fact: early on, Anthropic's agents spawned fifty sub-agents for simple questions.

Rule nine: plan for failure, because things will fail. Save a checkpoint after every step, so a crash resumes from where it stopped, instead of starting all over again. Retry failed calls with backoff. And make every action safe to repeat, with idempotency keys, so a retry never charges your customer twice.

Rule ten: trace everything. Record every model call, every tool call, and every decision, with tokens and cost, so when a run goes wrong, you can actually see why. Rule eleven: test before you ship. Anthropic started with just about twenty real queries, and used a model as the judge. And rule twelve: roll out slowly, moving traffic to the new version, step by step.

So, quick recap. Limit the steps, budget the run, intercept every tool call, ask a human for risky actions, and trace it all. An agent is a loop. Your job is to make sure it always ends. See you in the next one!