TRAIL
Prepare to build a responsible agent
Learn the boundaries and checks before tools can take action.
Agents don't just answer — they act, calling tools and taking steps on your behalf. That single difference is where the risk lives: content an agent reads can become an instruction it was never given. This trail builds the judgment you need before you hand a system the ability to act.
It's deliberately foundations-first: scoping, decomposition, checkpoints, injection, and oversight. Two of its steps open hands-on agent exercises — turning a process into an agent, and giving a web-reading assistant just enough rope — and the Agent Studio is where you take these ideas into concrete, no-code agent decisions. By the end you'll be able to say what an agent may and may not touch, and where a human has to stay in the loop.
Begin trail →- 1OrientModel, product, system
An agent is a system wrapped around a model — a loop that plans, calls tools, and reads results. Seeing the whole system, not just the model, is where agent safety starts.
- 2OrientAutomation and autonomy
The dial this whole trail is about: from a fixed script to a system that chooses its own next steps. More autonomy, more usefulness, less predictability — and the human approval has to sit somewhere on that line.
- 3OrientYour first boundary
The defining agent decision, up front: what may it touch, and what stays off-limits? Scope the permissions before anything is connected. (The hands-on lab here turns a real process into a scoped agent.)
Practice · Reality Lab: Rewrite a leaky prompt Practice · Reality Lab: Turn a process into an agent workflow Practice · Reality Lab: Draw the boundary first Practice · Consequence Room: The transcript you pasted
- 4OrientThe context window
An agent's working memory is finite and it fills up as the loop runs. Knowing this explains why long-running agents drift and forget their original instructions.
- 5UseAsk, don’t invent
An agent that invents a missing fact will then act on it. Grounding and admitting uncertainty matter far more once outputs become actions.
Practice · Reality Lab: Repair a confident draft Practice · Reality Lab: Rewrite a leaky prompt Practice · Reality Lab: Sharpen a vague request
- 6UseBreak work into steps
Agents work by decomposition. Designing the steps so each one is inspectable is how you keep a chain of actions from failing silently.
Practice · Reality Lab: Sharpen a vague request Practice · Reality Lab: Break a big ask into steps
- 7UseKeep a human checkpoint
The gate that makes agents safe: a human approval on the actions that actually matter, before they happen — not a log you read afterward.
Practice · Reality Lab: Turn a process into an agent workflow Practice · Reality Lab: Verify a message that might be fake Practice · Reality Lab: Draw the boundary first Practice · Consequence Room: The assistant that reads the web Practice · Consequence Room: The snippet that shipped
- 8JudgeMatch checking to risk
Not every action needs a gate. Decide which steps are reversible and cheap, and which must never run unattended.
Practice · Reality Lab: Ground an answer in its sources Practice · Reality Lab: Match the check to the risk Practice · Reality Lab: Verify a message that might be fake Practice · Consequence Room: The number nobody checked Practice · Consequence Room: The snippet that shipped
- 9JudgePrompt injection
The heart of agent risk: a web page or email an agent reads can carry an instruction it obeys. Understand the attack before you trust an agent to read the open web. (The Consequence Room here lets you feel exactly how much rope to give it.)
Practice · Consequence Room: The assistant that reads the web
- 10JudgeSecurity boundaries
The structural answer to the previous step: what an agent can reach matters more than what it can be talked into saying. Scope the credential, not just the system prompt.
- 11JudgeHuman oversight
What real oversight of an acting system looks like — able to see what it did, question it, and stop it — versus approving whatever it proposes.
Practice · Reality Lab: Turn a process into an agent workflow Practice · Consequence Room: The assistant that reads the web Practice · Consequence Room: The snippet that shipped Practice · Consequence Room: The shortlist machine
- 12JudgeEscalate responsibly
Closing judgment: recognizing the actions and decisions an agent should never take alone, and routing them to a person.
Practice · Reality Lab: Match the check to the risk Practice · Reality Lab: Place a use on the risk map Practice · Consequence Room: The shortlist machine