Agent-Ready Tooling Surface Checklist (v1)

Use this checklist before you scale any agent beyond a small pilot. Goal: make agent actions attributable, permissioned, reversible when possible, and debuggable.

1) Tool Inventory (start small)
- List the exact systems the agent will touch (e.g., Jira, GitHub, Salesforce, ServiceNow, Stripe, internal admin).
- For each system, list the minimal actions needed. Separate READ actions (query, fetch, list) from WRITE actions (create, update, delete).
- Pick one “thin slice” workflow: one system, one write action.

2) Tool Contracts (make ambiguity illegal)
- For every tool: define an explicit input schema (JSON Schema or equivalent).
- Require structured outputs (machine-parseable fields). Put human-friendly text in a separate field.
- Add idempotency for write tools (idempotency key or deterministic dedupe strategy).
- Standardize error responses (error code + message + retryable flag + context fields).

3) Identity & Permissions (no shared keys)
- No long-lived shared API tokens inside prompts or agent configs.
- Use scoped service identities where possible; prefer short-lived credentials.
- Map agent permissions to real roles: what can it read, what can it write, what is forbidden.
- Add an explicit “deny list” for sensitive objects (payroll, legal, prod secrets) unless the use case demands it.

4) Approvals & Safe Modes (design the friction)
- Classify actions:
 A) Read-only (no approval)
 B) Draft-only (agent prepares, human executes)
 C) Execute with confirmation (agent executes after explicit approval)
- For any destructive or external action (emailing customers, issuing refunds, deploys, deletions): require confirmation and show a diff or preview.
- Add a kill switch: one toggle to disable all write tools immediately.

5) Traceability & Replay (debug like a system)
- Log every tool call: timestamp, tool name, parameters (redacted as needed), tool response, and resulting next step.
- Correlate runs with a run_id across services.
- Store the exact retrieved context used for decisions (document ids + versions).
- Make runs replayable in a safe sandbox (same inputs, simulated tool responses).

6) Knowledge / RAG Hygiene (if you retrieve, you own the pipeline)
- Define ownership for indexing and connectors.
- Enforce access-aware retrieval (permissions must be applied at query time).
- Version your corpora and embedding changes; don’t swap models silently.
- Add regression queries: a small set of must-answer questions that should stay stable over time.

7) Promotion Rules (how the agent earns trust)
- Start read-only, then draft-only, then limited execute.
- Expand privileges only after you can explain failures with logs and traces.
- Document “known bad patterns” (what the agent must never do) as explicit policies.

If you can’t complete this checklist for a workflow, you’re not blocked by model quality. You’re blocked by operational readiness.