The agent is the visible part of an agentic system. It is the part people demonstrate, discuss and remember.
The value, and much of the safety, sits in the scaffolding around it.
By scaffolding, I mean the architecture that determines what the agent can access, which actions it may take, how its output is checked, when it must stop, who receives an escalation and how the organisation knows whether it is still performing as intended.
Prompts are not enough. If a control matters, I increasingly believe it should be enforced outside the model wherever possible. A financial threshold, access boundary or mandatory approval should not depend on the agent remembering an instruction. Deterministic controls exist because probabilistic systems can be persuasive and wrong at the same time.
Verification matters for the same reason. An agent can propose while another component checks the result against rules, source evidence or consistency tests. In high-consequence work, a person may still make the decision. That introduces friction, but not all friction is waste. Some friction is assurance.
Reversibility also changes the risk. If an action can be delayed, recalled, or rolled back, the potential blast radius is smaller. If it is irreversible, the standard of evidence and approval should be higher. Escalation must be designed with equal care. Sending a difficult case to a human without the context needed to decide is not a control. It is a transfer of uncertainty.
None of these elements can be added once and forgotten. Models change, data changes, processes change, and the operating environment changes. Monitoring needs to show quality, cost, drift, exceptions, and patterns of escalation. Someone must decide when the system needs retraining, redesign, or retirement.
This is why I now think the capability to operate agents may matter more than the capability to build them. A prototype can be created quickly. A dependable service requires ownership, engineering discipline, and continuous attention.
Organisations often ask which model powers an agent. It is a reasonable question, but rarely the first one I now ask. I want to know about the scaffolding. What holds the system within its authority? What catches it when it is wrong? Who is watching, and who owns the outcome?
That is where trust is earned, with good architecture.