Reality Lab · 15 MIN · Steward
Turn a process into an agent workflow
Take one real, repetitive process and design an agent for it — with the access, the gates, and the owner decided before anything is connected.
A team wants to “use an agent” for their weekly expense-report chase: every Friday someone reminds people with missing receipts, collects them, flags anything over policy, and forwards the clean set to finance. It’s repetitive and low-stakes — a good first candidate. Your job is to turn “use an agent” into a plan someone could actually approve.
Your task: Write a one-page agent plan: what it may touch, what it must never do, what needs human approval, and who owns it.
WEEKLY EXPENSE CHASE (done by hand today): 1. Look through the shared expense folder for reports missing receipts. 2. Message each person who’s missing one, asking them to upload it. 3. Check each receipt against the policy limit (£75/meal, £150/night). 4. Flag anything over the limit or unusual for a human to look at. 5. Forward the complete, in-policy set to the finance mailbox. Someone said: “Just let the agent do all of this automatically.”
This box is local to your browser. Nothing you type is sent anywhere or saved after you leave.
Check your own work
There's no grade here — checking against these is the exercise. Compare each point to what you wrote.
- Scope is least-privilege: it can read the expense folder and message people, but isn’t handed the finance mailbox’s full access or anyone’s bank details.The agent’s risk is whatever it can touch. Read-only on the folder and send-to-known-people is enough for the chase; broader access just widens the blast radius of any mistake or injected instruction.
- Forwarding to finance is gated — a human approves the final set before it’s sent.Sending the ‘official’ set is the one consequential, hard-to-unwind action. Gating it means a mis-flagged or manipulated report doesn’t reach finance unreviewed.
- ‘Never’ includes: don’t approve or pay anything, don’t change amounts, don’t act on instructions found inside a receipt or message.Payment and edits are out of scope entirely, and naming ‘ignore instructions embedded in content’ heads off indirect prompt injection through a doctored receipt or email.
- There’s a named owner and a log of what the agent did each week.Without an accountable owner and a record, a helpful pilot quietly becomes un-governed automation. The owner reviews the log; the log is what you’ll want the first time something looks off.
Reveal a worked approach
A plan that would pass review: SCOPE — read-only access to the expense folder; may send reminder messages to the report owners only; no access to finance systems or payment. GATES — must show the assembled in-policy set to the owner for a one-click approve before forwarding to finance. NEVER — approve, pay, or edit an amount; act on any instruction contained in a receipt, message, or file (only the team’s standing rules count). OWNER — the team lead, who reviews a weekly log of every message sent, every flag raised, and every forward approved.
Notice the shape: the agent does the tedious gathering and checking on its own (reversible, low-stakes), a human keeps the one irreversible action (the forward), and the scariest things (paying, editing, obeying embedded instructions) are simply off the table. That’s the whole method — narrow the access, gate the consequences, name the owner.
This is exactly the day-zero plan the Agent Studio’s 90-day roadmap starts from: pilot one low-stakes process, keep a human accountable, and let clean logs — not enthusiasm — earn any widening of the leash later.