Locate Tools, State, and Human Authority
Follow proposed actions through execution, durable state, verification, recovery, and accountable human control.
By the end
You will be able to
- Locate the executor and authorization boundary for each tool.
- Separate model context, workflow state, memory, and audit evidence.
- Distinguish attempted, accepted, completed, failed, and unknown effects.
- Identify where human approval and recovery authority remain.
The executor owns the effect
A trusted executor validates the typed request, caller, resolved target, permission, approval, budget, and idempotency key before acting. The model does not grant itself access. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
The result must distinguish refusal, validation failure, accepted work, completed effect, timeout, and unknown outcome. A timeout after a possible write cannot safely be retried until reconciled. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
{
"contractVersion": "1.0",
"executionBoundary": "bounded-task",
"inputValidation": {
"maxTokens": 4096,
"allowedModalities": ["text", "json"]
},
"outputSchema": {
"type": "object",
"required": ["status", "evidence", "confidence"],
"properties": {
"status": { "type": "string", "enum": ["verified", "rejected"] },
"evidence": { "type": "array", "items": { "type": "string" } },
"confidence": { "type": "number", "minimum": 0.0, "maximum": 1.0 }
}
}
}State has different purposes and owners
Working context helps the current decision. Durable workflow state survives restart. Memory retains governed facts or preferences. Audit evidence records accountable events. Treating all four as a chat transcript creates privacy and recovery failures. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
For each state class, record writer, reader, source, version, retention, correction, deletion, and conflict behavior. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
{
"contractVersion": "1.0",
"executionBoundary": "bounded-task",
"inputValidation": {
"maxTokens": 4096,
"allowedModalities": ["text", "json"]
},
"outputSchema": {
"type": "object",
"required": ["status", "evidence", "confidence"],
"properties": {
"status": { "type": "string", "enum": ["verified", "rejected"] },
"evidence": { "type": "array", "items": { "type": "string" } },
"confidence": { "type": "number", "minimum": 0.0, "maximum": 1.0 }
}
}
}Approval binds a person to an exact action
A meaningful approval identifies the action, target, parameters, evidence, approver authority, time, expiry, and permitted variation. Confidence or prior approval does not authorize a changed target. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
People retain authority over scope, consequential effects, exceptions, learner assessment, and publication. A model can recommend but cannot create that authority. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
{
"contractVersion": "1.0",
"executionBoundary": "bounded-task",
"inputValidation": {
"maxTokens": 4096,
"allowedModalities": ["text", "json"]
},
"outputSchema": {
"type": "object",
"required": ["status", "evidence", "confidence"],
"properties": {
"status": { "type": "string", "enum": ["verified", "rejected"] },
"evidence": { "type": "array", "items": { "type": "string" } },
"confidence": { "type": "number", "minimum": 0.0, "maximum": 1.0 }
}
}
}Unknown outcomes require reconciliation
Recovery starts from observed state, not from the agent's narrative. Inspect the real target, correlate the request, classify effects, and choose resume, retry, compensate, roll back, or escalate. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
A truthful agentic system can end failed, blocked, cancelled, budget-exceeded, needs-approval, or unknown. Converting uncertainty to success hides risk. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
{
"contractVersion": "1.0",
"executionBoundary": "bounded-task",
"inputValidation": {
"maxTokens": 4096,
"allowedModalities": ["text", "json"]
},
"outputSchema": {
"type": "object",
"required": ["status", "evidence", "confidence"],
"properties": {
"status": { "type": "string", "enum": ["verified", "rejected"] },
"evidence": { "type": "array", "items": { "type": "string" } },
"confidence": { "type": "number", "minimum": 0.0, "maximum": 1.0 }
}
}
}Practice activity
Build a responsibility and evidence map
- Choose one tool-using experience and trace a proposed action through validation, authorization, execution, result, and postcondition.
- Map working context, durable state, memory, and audit evidence to their owners and lifecycle controls.
- Define the exact human approval boundary and at least two terminal outcomes other than success.
- Challenge the design with an unauthorized target and a timeout after a possible write.
What to produce
- A responsibility map for identity, tools, state, approval, verification, and recovery.
- Failure traces showing fail-closed authorization and reconciliation before retry.
Reflect before continuing
Which boundary would be most dangerous to leave implicit?
Evidence
Sources and verification
- Create a MessageAnthropic · verified 2026-07-27
- DeepSeek tool callsDeepSeek · verified 2026-07-27
- Use Kimi API for tool callsMoonshot AI · verified 2026-07-27
Knowledge check
Make it stick.
Choose the strongest answer for each question. Your attempts become part of your account transcript.