Definitions

Definitions

Flow

Results

1. There is no universally right autonomy level; it follows classifier accuracy and the cost of a wrong action.
2. A moderate threshold plus tool preconditions was cheapest here and cut wrong actions sixfold compared with full autonomy.
3. Cost totals depend on my assumed penalties; replace them with your real cost of a wrong refund, a human minute and an unhappy customer.

Design rules

• Scope to a few intents with written rules; route everything else to people.
• Keep policy in code, not in the prompt; the model only proposes.
• Put preconditions in the tools and make state changes idempotent.
• Derive customer and tenant from the session, never from the model's arguments.
• Escalate early and well: thresholds, limits, language triggers, a handoff packet, and an SLA clock.
• Start in assist mode, collect real error rates, then raise autonomy one intent at a time.
• Measure calibration before trusting confidence thresholds.
• Risk-tier operations commands; unknown means approval; destructive means blocked.
• Cap blast radius and write rate; pair with a kill switch (Level 11 module 11).
• Review samples weekly of both automated and escalated tickets.

Interview questions, with the follow-ups

Common mistakes

• Policy only in the prompt, so one clever message overrides it.
• Tools with no preconditions, trusting the model to check.
• Taking customer or tenant ids as model arguments.
• No idempotency key, so a retry refunds twice.
• Choosing a confidence threshold by feel without measuring calibration.
• Automating everything on day one.
• Escalating with no context, so the human starts over.
• Counting only automation rate, ignoring wrong actions and reopens.
• Letting an operations agent run arbitrary shell commands.
• No sampling of automated tickets, so silent errors persist.

What the example does not do

• No model: triage is a simulated noisy classifier with invented calibration; real models fail differently and their confidence is often poorly calibrated.
• Single-turn tickets: no conversation, clarifying questions, tone, language or customer history.
• Invented mix, order states and costs: the cost-optimal policy will move with your numbers.
• Human errors are ignored: escalated tickets are assumed handled correctly, which flatters the assist and guarded modes.
• Wrong replies are cheap: the model of customer harm (churn, complaints) is crude.
• Operations agent is a classifier of strings, not a real shell guard; regular expressions are easy to evade, so it needs real permissions and sandboxing underneath (Level 10 modules 2 and 3).
• No SLA, queueing or staffing model for escalations.
• Optional real experiment (I did not run this): replay a month of your real tickets through a real classifier in shadow mode, measure accuracy, calibration, wrong-action rate and escalation load, and recompute the cost table with your own penalties.

For the curious More autonomy is not simply cheaper

In the 1,000-ticket simulation, autonomous with tool checks automated 86 percent but made 24 wrong mutating actions ($1,003 refunded wrongly); the guarded policy automated 33 percent with 3 wrong actions and $0 wrongly refunded. A threshold of 0.7 was the cheapest sweep point at $1,990. Mix, accuracy and costs are assumed.

What you must be able to say (one page)

• Support agents are the most common production agent. They handle common inquiries, process refunds, update orders and escalate complex issues to humans, around the clock. The running example is a support team reading free-form emails (refund a broken mug, cancel an unshipped order, change an address), looking up the order, calling an API and typing a confirmation. Operations (IT help desk) agents manage access, troubleshoot, deploy updates, respond to incidents and escalate unresolved issues.

• Scope narrowly. Too narrow (only cancellations) misses the high-volume requests; too broad ("automate every support inquiry") drowns in edge cases such as billing disputes, recommendations and technical troubleshooting. Pick a few intents with clear rules, and send the rest to people.

• The model reads and drafts; code decides. Triage (intent plus confidence) comes from a model; the policy lives in code: confidence threshold, refund limits, legal and fraud language, billing disputes always to a human. Tools enforce their own preconditions (refund only if delivered, inside the 30-day window and not already refunded; cancel and address change only before shipping; an order that is not yours looks the same as one that does not exist), and refunds take an idempotency key so retries cannot pay twice (Level 11 module 1). Routing rules can also be encoded in the orchestration graph.

• Autonomy is a dial, not a switch. The range runs from fully manual, to assisted "Ask" mode, to fully autonomous execution. In my simulation (1,000 tickets; assumed mix, 88 percent classifier accuracy and costs): assist-only automated 0 percent at $4,020 cost; autonomous with tool checks only automated 86 percent with 24 wrong mutating actions ($1,003 refunded wrongly), 62 wrong replies, cost $2,129; guarded (threshold 0.8, $50 auto-refund cap) automated 33 percent with 3 wrong actions and $0 wrongly refunded, cost $2,750.
• Tool preconditions blocked 62 wrong attempts in autonomous mode (for example a refund requested for an order not yet shipped). They turned into wrong or unhelpful replies ("I cannot do that") instead of wrong actions, which is the better failure. Safety that lives in the tool survives a confused model.
• The right autonomy depends on accuracy and on the cost of a mistake. Sweeping the confidence threshold: 0.5 gave 57 percent automated, 12 wrong, $2,047; 0.7 gave 54 percent, 4 wrong, $1,990 (the cheapest, and 6 times fewer wrong actions than autonomous at about the same cost); 0.9 gave 17 percent, 0 wrong, $3,356. Changing classifier accuracy: at 95 percent, autonomous was cheaper than guarded ($1,385 vs $2,654 at threshold 0.8); at 75 percent it was far worse ($4,157 vs $2,981, 55 wrong actions). The cliff between 0.7 and 0.8 is an artifact of my assumed confidence distribution; a real model's calibration must be measured, and thresholds tuned on real traces.
• Escalation is a feature. A handoff packet gives the human the ticket, the order, the reason, what the agent already tried and a suggestion, so nobody re-asks the customer. Escalate on low confidence, large amounts, legal or fraud language, billing disputes, repeated failures and angry customers.
• Operations agents need risk tiers. My sample classifier sorts commands into read-only (run), mutating (needs approval), forbidden (blocked: rm -rf, DROP TABLE, --force, force push), treats unknown commands as risky, caps the blast radius (targets per action) and the write rate per hour (a circuit breaker; Level 10 module 9). Dry-run first, approval for production changes, an audit trail.
• Measure what the business cares about: resolution rate, cost per resolved ticket (Level 11 module 5), customer satisfaction, escalation quality, wrong-action rate and reopen rate; sample escalations and automated resolutions for human review weekly.
• Honest limits: a simulated classifier, invented mix and costs, six intents. Real tickets are ambiguous, multi-turn and emotional; real calibration is worse than my uniform assumption.