Turn a Job Role Into an Agent Task Spec: Scope, Limits and Escalation in Code

When a team says "we want an AI employee", the first job is not picking a model. It is cutting a role into tasks you can specify, limit and check. Here is one way to write that down as code.

This is an illustrative role (sales operations analyst), not a customer story. I have no performance numbers to share.

Step 1: List tasks, not the role

from dataclasses import dataclass, field
from typing import Literal

@dataclass
class TaskSpec:
    name: str
    inputs: list[str]
    allowed_tools: list[str]
    output: str
    owner: str                      # a named human
    escalate_when: list[str] = field(default_factory=list)
    mode: Literal["workflow", "agent"] = "workflow"

TASKS = [
    TaskSpec("clean_lead_list", ["crm.leads"], ["crm.read", "crm.update_field"],
             "list of fixes with reasons", owner="ops_lead",
             escalate_when=["merge two records"]),
    TaskSpec("draft_followup", ["lead", "last_call_notes"], ["crm.read", "email.draft"],
             "draft only, never sent", owner="sales_rep",
             escalate_when=["price mentioned", "refund mentioned"]),
]

Notice mode. Anthropic's guide separates workflows (fixed code paths) from agents (the model picks the steps) and says agents bring higher cost and compounding errors, so test them in a sandbox with guardrails. Start every task as a workflow. Move one to agent only when the steps truly cannot be fixed.

Step 2: Enforce the limits outside the model

def run(task: TaskSpec, call_tool, request):
    for step in plan(task, request):
        if step.tool not in task.allowed_tools:
            return escalate(task, f"tool not allowed: {step.tool}")
        if any(w in step.text.lower() for w in task.escalate_when):
            return escalate(task, f"rule hit: {step.text[:60]}")
        result = call_tool(step)
        audit_log(task.name, step, result)
    return finish(task)

The allowed list and the stop words live in your code, not in a prompt. A prompt can be argued with. A check in code cannot.

Step 3: Make a person own each task

owner is a required field. If a task has no owner, it does not ship. The owner reviews a weekly sample from the audit log and can switch the task off.

Step 4: Keep the claims small

• Draft, do not send, until the owner trusts a task.
• Log every tool call with inputs and outputs.
• Write the stop rules from real incidents, not guesses.

What I would not claim

An agent here is a bundle of tasks with limits. It is not an employee in any legal sense, and this spec does not replace a role. Microsoft's 2025 Work Trend Index describes agents as "digital colleagues" taking tasks at human direction, and calls the person who manages them an "agent boss". That matches the owner field above.

The next step is a review loop: sample the log, tighten the rules, then widen the task.

Tej Pandya, founder of GrowEasy.ai.