Free, no sign-up

Should you build that agent?

Most proposed agents are governed retrieval wearing a more expensive hat. This test applies four criteria to the list you are planning and tells you which ones survive. Expect it to say no more often than yes.

The Test

List what you are planning to build

One or two words each. Then answer five yes or no questions for every one. Two of them decide whether it is an agent. Three decide what it needs before it is safe to build. Nothing is sent anywhere, nothing is stored, and there is no sign-up.

  1. Is it an agent?

    Either one of these justifies it. Neither, and it is retrieval.

    1.Does what it does next depend on what it just found?

    The path through the work is decided at run time. If you can draw the whole flow in advance, you can write the whole flow in advance, and then it is a script.

    2.Does it need to run when nobody is there, and work out what to do when it does?

    Both halves are required. A schedule alone does not justify an agent, because a scheduled script runs unattended too. What makes it agentic is that the choice of what to do is not fixed in advance.

    What will it need?

    None of these justify an agent. They decide what has to exist before whatever you build is safe.

    3.Does it reach two or more systems, under one identity?

    This cannot justify an agent: a scripted integration does exactly this. What it decides is how wide the allow-list has to be, and whose identity the thing acts under.

    4.Does it enforce a rule, and does the record of that have to stand up later?

    This cannot justify an agent either: a policy engine refuses and logs the refusal without a model involved. What it decides is how defensible the record has to be.

    5.Does it change anything in a live system?

    The one that stops a build. Anything that writes needs a control model agreed before it is built, not retrofitted after someone asks how it was allowed to.

Result

Answer all five questions for every agent to see the result.

The case people argue about

Onboarding that answers questions is retrieval, not an agent, however many systems it reads from. Onboarding that tracks where someone has got to, notices what they have not covered and adapts is stateful, which is agentic, and it needs memory, which carries its own governance problem. Same word, two different products.

The test is the first of four deliverables

Knowing which agents are justified is the easy part, and it is the part we give away. The tool inventory, the control model and the eval set are what a security function actually signs off, and they are what the knowledge audit produces.

See the agent work
Talk to Us