An assistant that answers questions can tolerate imperfect data; a person reads the answer and applies judgment. An agent that acts cannot. Before an agent is allowed to change a record, six questions about the data it depends on need clear answers.
1. Who owns it?
Every dataset an agent reads or writes needs a named owner who can approve access and is told when something breaks. If the answer is a team alias or a retired project name, the agent is not ready to depend on it.
2. How fresh is it, and how do you know?
Agents make decisions in the moment. A warranty record that is a day old or an inventory position that updates nightly may be fine for reporting and wrong for action. Freshness needs to be measured and exposed, so the agent, and the people supervising it, can tell when the data is stale.
3. What is the agent allowed to change?
Read access and write access are different decisions. Define the specific fields and transactions an agent may touch, the limits on each, and what requires a person’s approval. Scoped credentials should enforce those limits; a prompt should not be the only control.
If nobody can say what an agent is permitted to change, the honest answer is nothing.
4. Can you trace what it used?
When an agent’s action is questioned, someone has to reconstruct which records it read and which version of them. Lineage and logging that link an action to its inputs are what make an audit, or a simple correction, possible.
5. What happens when the data is wrong?
Data will be missing, duplicated, or contradictory. Decide in advance how the agent should behave: stop, ask, or proceed with a flag. An explicit exception path is cheaper than discovering the default behavior in production.
6. Who is told when it changes?
Schemas shift, codes are retired, upstream systems are replaced. Agents fail quietly when that happens. A data contract, even a lightweight one, that notifies the agent’s owner of changes prevents a category of incident that is otherwise hard to diagnose.
None of these questions is about models. Teams that can answer all six for a workflow usually find the agent itself is the easier part of the project.