# Production Agent Systems
All Production Agent Systems notes →1. Guardrails
Input and output validation layers that constrain what an agent can say or do — schema-constrained outputs, content-safety classifiers on both directions, and where guardrail checks sit in the request path so they add acceptable latency without becoming a bypassable afterthought.
2. Prompt Injection
Authentication, authorization, and secrets management for an agent, plus the genuinely agent-specific threat: prompt injection defense and data privacy in a tool-calling loop.
3. Jailbreak Prevention
Defending against adversarial prompts designed to override system instructions — prompt-injection-resistant system prompt structuring, delimiter and instruction-hierarchy techniques, and red-teaming the agent against known jailbreak corpora before it ships.
4. Sandboxing
Isolating code-execution and shell-access tools from the host and from each other — container and VM-level isolation, filesystem and network egress restrictions, and resource limits that stop a single tool call from taking down the runtime it shares with other tenants.
5. Identity & Authentication
How an agent authenticates itself to downstream systems and how end users authenticate to the agent — service-to-service identity (mTLS, workload identity) versus delegated user identity (OAuth token pass-through) when the agent acts on a user's behalf.
6. Authorization & Permissions
Scoping what actions an agent is allowed to take on a user's or tenant's behalf — least-privilege tool permissions, per-tool RBAC/ABAC policy, and the distinction between what the LLM is capable of requesting versus what the runtime will actually authorize.
7. Secrets Management
Keeping API keys, database credentials, and provider tokens out of prompts and tool code — vault-backed secret injection at call time, rotation without redeploying the agent, and why a secret ever appearing in a logged prompt is a sev-1, not a nit.
8. Human Approval Systems
Human-in-the-loop gates for high-stakes agent actions — designing the approval UI/API contract, timeout and escalation behavior when no human responds, and audit-trail requirements for what was approved and by whom.
9. Compliance
Mapping agent behavior to regulatory obligations — data residency for prompts and logs, retention and deletion policy for conversation history, and the audit evidence a compliance review will actually ask for (GDPR, SOC 2, industry-specific rules).
10. AI Governance
Organizational policy for what agents are allowed to be built, what models they may use, and who signs off before an agent goes to production — model risk review, an internal registry of approved agents and tools, and escalation paths when a team wants an exception.
11. Failure Recovery
How an agent detects and recovers from failure mid-task — partial-completion checkpointing, retry-with-backoff versus fail-fast policy per failure class, and distinguishing a transient provider error from a genuine task failure that needs human escalation.
12. Rollback Strategies
Reverting a bad prompt, model, or tool-schema change quickly — versioned prompt and model artifacts as first-class deploy units, canary and shadow rollout patterns for agent changes, and the rollback trigger thresholds tied to online-evaluation regressions.
13. Circuit Breakers & Timeout Strategies
The containment mechanics one level below failure-recovery policy: circuit breakers that stop one failing tool or sub-agent call from cascading through a run, timeout budgets allocated across a multi-hop tool chain, deadlock/oscillation detection between cooperating agents, and the runaway-loop breakers that cap a retry-or-replan cycle before it becomes a cost incident.
14. Trust & Explainability
The human-factors problem underneath every approval gate — why users either over-trust an agent past its actual competence or route around it entirely, what it takes for an agent's confidence signal to mean something, and the difference between a post-hoc justification and a real causal trace a reviewer can actually evaluate.