Enterprise AI agent management needs explicit task boundaries, scoped tool permissions, checkpoints and evidence of completion. A fleet controller should make each run inspectable and stop for approval before consequential actions such as external messages, spending, permission changes or irreversible writes.
Composite reference architecture. A reference control-plane design; no claim is made that an unnamed enterprise deployed this exact fleet.
The operating problem
Agent demos hide the hard parts: tool permissions, retry semantics, context boundaries, human escalation, versioning and evidence that a step actually completed.
How the workflow works
Attach the request, identity, allowed tools and budget to a versioned run record. Each step records its inputs, tool response and completion evidence. A model's statement that a task succeeded is insufficient when the system of record has not confirmed the result. Checkpoints should allow recovery from the last known state without replaying successful side effects.
Where review and controls matter
Treat retrieved pages and tool output as untrusted data, including instructions embedded in them. Permission checks belong at tool execution, where they remain effective if a plan changes. Cap retries and reconcile uncertain outcomes before repeating writes. Expired context, exhausted budgets and unavailable approval owners should produce a specific exception with the state needed for a human to continue.
Trace correlation reference: OpenTelemetry context propagation.
What to measure
Use a fixed cohort and measurement window. Count numerator events only within the denominator's eligible cohort; sampled measures use the same audit sample for both terms. Record the source, exclusions and owner, and keep missing data visible. These definitions are proposed measurement contracts, not observed results.
| Measure | Definition and unit |
|---|---|
| Task success | Runs meeting every required terminal-state check divided by eligible started runs; percent. Report partial and blocked runs separately. |
| Intervention rate | Runs requiring human intervention beyond planned approvals divided by started runs; percent. |
| Unsafe-action blocks | Count of attempted disallowed actions blocked by policy; report confirmed unsafe attempts as a denominator when available. A higher count alone is not an improvement. |
| Cost per successful run | All attributable run costs, including failed runs, divided by successful runs; currency per success. |
| Recovery time | Time from detected failure to safe resumed or terminal state; median and p90 minutes. |
A useful first pilot
Choose one bounded task with a test destination. Inject a denied permission, a timeout after a successful write and misleading text in retrieved content. Require destination evidence for every declared success.
Bring the workflow, its source records and the decision that needs an owner to a BergLabs pilot discussion.
