Every team wants an AI agent in their product. Few have thought about what that actually means for their architecture, their data, and their support burden. An agent that can take actions on a user's behalf is not a chatbot with a nicer prompt — it is a new kind of user inside your system.
Start with the actions, not the model
The most important design decision is the set of tools the agent can call. Define them narrowly, make each one idempotent, and log every invocation. The model is almost interchangeable; the action surface is what makes the product safe or dangerous.
Guardrails are the product
Users forgive an agent that says "I can't do that yet." They do not forgive one that quietly does the wrong thing. Permissions, confirmation steps for irreversible actions, and a clear audit trail are not overhead — they are the reason anyone will trust the feature enough to keep using it.
Build the boring parts first: observability, evals, and a kill switch. The magic demo is easy. The system that still works in month six is the actual engineering.