The boring half of an agent is the half that matters

I’ve been building a personal agent that runs a loop on someone’s behalf — wakes up, reads the context, decides, acts. The interesting-sounding part, the reasoning, took a weekend. The part that made it trustworthy took everything after.

The thing that changes everything is that it runs unattended. A loop you watch forgives a lot — you catch the bad call before it lands. A loop that runs while you sleep forgives nothing: every weakness that was theoretical becomes a real action, taken at 3am, on someone’s real account. So the engineering stops being about how well the thing reasons and starts being about what happens when it reasons wrong.

Supervised, an agent’s mistakes are suggestions. Left alone, they’re actions.

What “trustworthy” meant turned out to be concrete and unglamorous — and almost none of it is about the model. It’s the plumbing that decides whether you can leave the thing running:

Idempotency

Every run carries a request id and a content hash, so the same trigger can’t quietly fire twice and act twice.

Preflight & dry run

It states what it’s about to do before it does it — and a dry run turns a wrong decision into text on a screen instead of a side effect in the world.

Real context

Timezone and identity resolve to the person’s actual day, not the server’s guess — “remind me tomorrow” is a promise about their life, not the data center’s.

Observability

Every decision and action is recorded, so “why did it do that?” always has an answer you can go read.

Not one of those makes the agent smarter. Every one makes it safe to be wrong. None of it demos well. All of it is the line between a toy and something you’d let touch your life.

The loop itself is almost boring — four steps, and three of them are routine. The trustworthiness lives in the one right before it acts.

Preflight is the whole game: the single place a wrong decision is caught as words before it becomes a side effect. It’s cheap insurance, and it’s what makes the autonomy affordable at all.

It’s the same lesson as the field notes, in a new domain: the demo is not the product. With agents, the gap between the two is mostly idempotency, observability, and the humility to do a dry run before you do the real thing.

The uncomfortable part is how little the impressive half and the trustworthy half overlap. A capable agent is nearly free now: you call a model. Turning capable into trustworthy is a different discipline, closer to distributed-systems hygiene than to clever prompting. Making it trustworthy is separate, slower work.

That’s why I trust the boring half more than the clever one, and why this is the same conviction as “humans in the loop is not a safety plan,” now load-bearing. When the agent acts unattended, the scaffolding is the oversight. It’s what I’d want standing between a model and a patient.

Underneath idempotency sits a harder problem I did not expect. The agent reasons over a snapshot of the world — the files, the state, the context it read a moment ago. In anything live, that snapshot is stale before it acts, and a model has no instinct for it. Everything in its window is equally, timelessly now; it carries no sense that a fact it read has since gone out of date.

I watched this from the other side while building this page. I had an AI agent helping me build this page, and it kept acting on a world that had already moved. It read a file; I edited the file; it moved to write over what it thought was still there. It checked a dev server that was serving stale output, where a clean 200 described a page that had already changed underneath it. The reasoning was never the weak point. The grip on now was.

The dangerous agent isn’t the one that’s wrong. It’s the one that’s confident about a world that already moved.

So the deepest version of the boring half is this: treat the agent’s own context as a cache with a short TTL. Re-read at the last moment. Reconcile against the source of truth before committing: the screen, not the database; the file on disk, not the one you remember reading. A current, reconciled picture of the world is the expensive part, and the one thing the model cannot hand you.