An agent without an owner is a product with no PM
Every agent I have put in front of a real person makes decisions. It books something, withholds something, invents something, or hands off. Those are product decisions. Most teams I see treat them as a model problem, or a legal problem, or nobody's problem.
I learned this the hard way on a concierge that answers guests on the phone, over text, and on the web. A guest standing at a locked gate does not care about your policy PDF. They care whether the system tells them the code, invents a restaurant, or quietly makes a mess.
The work that made it safe was not a better prompt. It was naming what the agent is allowed to do without asking.
Write the allowlist before the prompt
I run agents against my own work the same way. A small set of jobs can run without me: restart a stuck poller, retry a failed backup, kick a health check. Everything else is a proposal. Code changes, credentials, money, anything that leaves the machine. The agent drafts. I approve.
That split is the whole product. Autonomy is not a personality trait of the model. It is a list of verbs you are willing to let run unsupervised, and a list you are not.
On the concierge, the allowlist was similarly boring and similarly load-bearing. Pull live restaurant hours. Read the weather. Answer from the property guide. Never invent a venue. Never claim a booking is confirmed. Never reveal a gate code unless that booking is active. Hand off when the request is outside the list.
The interesting part is how short the list is. Most of what people want an agent to "just handle" does not belong on it.
Governance that lives next to the product is orphaned
I keep seeing the same org chart. A risk team writes an agentic AI framework. Engineering ships the agent. Product is not named on the decisions the agent makes about a customer.
Then something happens. A refund gets processed. A clinical question gets guessed. A private detail leaks to the wrong person. Everyone looks at the model card.
The model did what it was optimized to do. Nobody had defined the job.
If an agent can change a calendar, a record, a payment, or a person's evening, it needs a product manager the same way a checkout flow does. Scope, escalation, fallback, and the outcome you will defend in a room. A framework that sits in legal does not own any of those.
The test I use now
Before I let an agent talk to a user, I can answer four questions out loud.
Who is the named owner of what it decides. What it may do without a human. What it must never do, even if the model is confident. How we will know, from an outcome, that it did the job.
If any of those are fuzzy, it is still a demo. Demos are allowed. They are not allowed to answer the phone.
The companies that will get value out of agents this year are not the ones with the longest policy. They are the ones who treated the agent as a product surface, gave it an owner, and made the allowlist shorter than the prompt.
If you are trying to put an agent in front of customers and cannot yet name those four things, that is the work I take on.