A demo agent is easy to trust: you watched it work. A production agent is different because nobody watches the 3 a.m. run that refunds the wrong order, retries the wrong request, or calls a tool with almost-right arguments.
Before an agent is allowed to act at scale, every tool call should be able to answer five questions later, from logs alone:
- Who or what authorized this action? A user request, a scheduled job, another agent, or a policy rule should be distinguishable after the fact.
- What exactly reached the model? Keep the raw input next to the extracted intent. When the summary and the source disagree, the source is how you debug it.
- Which route actually served it? Record the model and provider that served the final attempt, not just the first choice in the config. Failover makes "what we asked for" and "what answered" different facts.
- What changed in the world? A tool call that reads is not the same risk as one that sends, pays, deletes, or updates. The log should make the blast radius obvious.
- Can this be replayed or undone? If the answer is no, the action needs a tighter gate: confirmation, a value threshold, or a human review queue.
The pattern I keep coming back to: treat the request log as evidence, not exhaust. If a bad action cannot be reconstructed, the team does not really have observability — they have a dashboard and a hope.
What is the one log field you added only after an agent incident taught you the hard way?
We keep collecting these patterns in public — longer notes on Hashnode, events on lu.ma.
Top comments (0)