50. A Design Method for Agentic Systems
You can recite every chapter and still greenfield a mess: agents first, tools second, eval never.
ShopOps’s failure mode on a fresh build is method inversion — Intake, Resolution, Policy, and Outreach sketched on a whiteboard before anyone writes the action table, send-window policy, or a golden O-1001 fixture. Week six, Outreach sends outside the window because rules lived only in a system prompt.
environment → actions → state → trust → policy (+ send window, required fields) → model niches → memory → failures → evals → HITL → observability → deploy → feedback
Reliable agency is better systems around probabilistic intelligence. Autonomy is earned; governance is designed.
This chapter adds the twelve-step delivery order — each step produces an artifact; skip a step and Chapter 49’s catalog writes itself.
First principles
Work the twelve steps in order. Skipping to models and multi-agent roleplay is how Chapter 49’s catalog writes itself.
Each step produces an artifact. No artifact means you skipped the step — not that you were agile.
The twelve-step method
1. Environment
Define what the system senses and what “done” means.
Artifact: environment notes — systems of record, SLAs, episode boundaries.
ShopOps: support ticket / exception events, OMS/CRM, payment/refund rails, channel gateways; case closes on plan, escalate, or freeze.
2. Actions
Enumerate a closed or constrained action vocabulary. Mark read vs write vs irreversible.
Artifact: action table with side effects.
ShopOps: get_order, draft_email, send_email, add_order_note, escalate, …
3. State
Specify structured state and (s_{t+1}=F(s_t,a_t,o_{t+1})). Chat is not enough.
Artifact: state schema + FSM sketch.
ShopOps: CaseState, awaiting_approval, checkpoints.
4. Trust boundaries
Label untrusted inputs (user text, ticket notes, tool bodies, retrieval).
Artifact: trust diagram.
ShopOps: ticket free text never authorizes send.
5. Policies
Encode permit/deny in code; version packs.
Artifact: policy pack + tests.
ShopOps: send window, frequency caps, required-field checks.
6. Model niches
Decide where an LM helps vs where code/rules suffice. Route models deliberately.
Artifact: niche table (task → model class → fallback).
ShopOps: tiny model for intent; larger for strategy narrative; deterministic policy first.
7. Memory semantics
Name memory kinds; write/forget policies; privacy deletes.
Artifact: memory matrix + controller rules.
ShopOps: profile facts with provenance; no raw tool JSON as memory.
8. Failures
List distributed and agent-specific failures before launch.
Artifact: failure mode and effects list (timeouts, double send, injection, loops).
ShopOps: email gateway 503, worker death, poisoned notes.
9. Evals
Trajectory properties, fixtures, simulators — before broad autonomy.
Artifact: harness + ring-0/1 tests in CI.
ShopOps: golden O-1001; hostile loop fixture; send-window properties.
10. Human authority
Define who approves what, timeouts, safe defaults.
Artifact: HITL matrix + queue UX data model.
ShopOps: refund-or-reship threshold → human; timeout → no send.
11. Observability
Traces, cost, run-diff, audit packs.
Artifact: trace schema + dashboards + evidence export.
ShopOps: reconstruct one failed send end-to-end.
12. Rollout / rollback
Shadow, stage, pin versions, rollback drills.
Artifact: rollout plan with kill switches.
ShopOps: dry-run channels → percent shadow → prod pins for prompt/policy/model.
Concrete example (compressed)
Greenfield “KYC assist” (adjacent domain) through the twelve:
| Step | KYC sketch |
|---|---|
| 1 | Docs upload + registry APIs; episode = one application |
| 2 | extract_fields, compare_registry, request_docs, escalate, approve_draft |
| 3 | Application FSM; checkpoint each stage |
| 4 | Uploaded PDFs untrusted; registry JSON structured |
| 5 | Jurisdiction rules in policy pack |
| 6 | LM for extraction assist; code for registry match |
| 7 | Intake facts vs raw OCR blobs |
| 8 | Partial docs, registry timeout, spoofed PDFs |
| 9 | Fixtures for mismatched ID; never auto-approve |
| 10 | Human for final approval always |
| 11 | Evidence pack per decision |
| 12 | Shadow extraction before any write to core |
Diagram
flowchart LR
e1[1 Environment] --> e2[2 Actions]
e2 --> e3[3 State]
e3 --> e4[4 Trust]
e4 --> e5[5 Policies]
e5 --> e6[6 Model niches]
e6 --> e7[7 Memory]
e7 --> e8[8 Failures]
e8 --> e9[9 Evals]
e9 --> e10[10 HITL]
e10 --> e11[11 Observability]
e11 --> e12[12 Rollout]
e12 --> e1
Caption: The method is a loop — production learning returns to environment and evals (Ch 41), not to silent policy mutation.
Implementation
Design-doc skeleton:
# Agentic system design: <name>
## 1 Environment
## 2 Actions (table)
## 3 State / FSM / F
## 4 Trust boundaries
## 5 Policies (pack versions)
## 6 Model niches
## 7 Memory semantics
## 8 Failure modes
## 9 Evals / fixtures
## 10 Human authority
## 11 Observability / audit
## 12 Rollout / rollback
## Non-goals
## Open gaps (Ch 48 IDs)
## Chapter 49 checklist results
Refuse implementation kickoff until steps 2, 5, 9, and 10 exist as artifacts.
Failure modes
| Skip | Typical blow-up |
|---|---|
| 2 | Unbounded tool use |
| 4–5 | Injection → unauthorized send |
| 9 | Silent policy regressions |
| 10 | Rubber-stamp HITL or none |
| 12 | No rollback after bad prompt |
Production considerations
- Re-run the twelve when expanding autonomy — earning autonomy is re-certification, not a one-time ceremony.
- Map frameworks onto these steps (Appendix G); if a framework hides a step, you still own the artifact.
- Regulated domains: keep SR 11-7-style change control on model-adjacent artifacts. [VERIFY applicability]
Chapter summary
- Reliable agency is systems design around probabilistic intelligence.
- Twelve steps: environment → actions → state → trust → policies → model niches → memory → failures → evals → HITL → observability → rollout/rollback.
- Each step leaves an artifact; no artifact means skipped work.
- Autonomy is earned through evals and governance, not declared in a kickoff slide.
- Return outcomes through gated loops (Ch 41–46), not magical self-rewrites.
Exercises
- Apply: Run all twelve steps for a support-desk agent; submit the design doc skeleton filled in.
- Apply: Same for claims processing; mark which steps differ from ShopOps.
- Gap: Attach Ch 48 IDs to any step you cannot complete honestly.
- Review: Score a past project against the twelve; list the first skipped step and the incident it predicted.
References
- This book’s architecture and style guides — method consolidates them.
- SR 11-7 — model risk change control. [VERIFY]
- Anthropic, Building Effective Agents — when workflows beat agents. [VERIFY URL]
- Cross-links: Ch 41–49; Appendices C–E; Appendix G.
Closing the book
You started with a completion. You end with a control plane: state, policy, memory, eval, humans, traces, and a method for the next domain.
The models will improve. The need for boundaries will not expire. Build the machine that makes a sampler’s judgment safe to act on — then earn each increment of autonomy with evidence.
Go build one for a problem you actually have. Start at step 1.