The work I can now hand over

I want to be able to give AI a job and get on with something else while it does the work. Preferably a fairly complicated job, where someone needs to find the material, read it with the right questions in mind, try a solution and work through what still needs improving. When I return, I want something I can assess without having had to direct every step along the way.

That is a large part of what drew me to agents.

An ordinary conversation with AI can be very useful. I ask a question, read the answer and decide what to do with it. An agent can also use tools: opening files, making a change and checking the result before continuing. How far it can go depends on its environment and access. What counts is what it can do, whether or not the interface looks like a chat. Anthropic describes how the model chooses its next action in response to the previous result.

I have become more interested in that possibility than in endlessly improving the wording of an individual question. I want a way of working that I can return to and improve, where last week’s decisions still apply when the next assignment begins.

A setup that knows the work

At RENAVID, I have divided the work between agent roles. The Writer works on the texts. The Social Desk prepares posts and briefs the Studio to make images and films. Work on the website includes its development and maintenance. Separately, a coding agent helps build the system for our property business.

These are roles for AI to work in, each with its own assignments and material. I start the work and review what comes back. I have not built a small organisation that runs itself around the clock.

Much of the setup is quite ordinary: folders and text files. They contain instructions for the role, decisions we have made and material from earlier work. The Writer, for example, needs to find both our writing rules and my comments in the piece being rewritten. The Studio needs a clear script and visual references. Giving a folder a name does not make it an agent. It gives the model a working context when I start an assignment.

This has changed how much I can produce. I can work on writing, visual material, a website and our own software in a way that would otherwise have required buying in or hiring for several different skills. That breadth matters to a business still taking shape.

It also takes hours of my day to make it work. I write assignments, improve instructions and review deliveries. Sometimes the work is good enough to take forward. Sometimes I need to explain what is missing and ask for a substantial rethink, as I would with someone still getting to know how I work.

An increasing part of my job is beginning to resemble management. That makes me quite particular about what I have actually asked for.

When a proposal becomes a promise

The same applies to an agent in property operations. Asking it to “handle maintenance requests” sounds reasonable until you start separating the decisions contained in those words.

Take a hypothetical report that a flat is cold again. I would gladly hand over the work of assembling what the tenant says now, the notes from the previous visit and any record showing whether the recommended work was carried out. If there is only a recommendation, I want that to be clear. The person assessing the case could then work from a single account, with references to the originals and any gaps made visible.

That is already a useful delivery. It does not give the agent permission to book another visit. Even if the evidence suggests someone should go, there are still decisions about who, when and what we should promise the tenant. A suggestion of Tuesday can be reviewed and changed. A message confirming Tuesday gives someone a reason to arrange their day around us.

In that setup, I would keep tenant replies, bookings and orders with a person. The agent can prepare them. That gives me something much easier to assess than a general promise to automate the whole case.

Ordinary verbs help. Read these documents. Assemble the history with references. Draft a reply and leave it for review. Both the property manager and the person setting up the service can understand what should exist when the work is finished. “Handle” can conceal a disagreement: one person expects a draft while the other has built a system that sends the reply.

The coding agent we use today helps build our property system. It has not been assigned to manage tenant cases itself. The maintenance request is an example of how I would limit such an assignment when we come to it.

Writing “never send” is only a beginning

If the agent’s job ends at a draft, I want its access to tools to end there too. It needs a way to leave the proposal with the right person. It has no need for a tool that sends it to the tenant. If nobody approves the proposal, no message should go out.

Writing down where the job ends is one part of the setup. I also need to check what the account and its tools actually allow. Limited permissions and human approval for sensitive actions are among OWASP’s recommendations for agent security.

There is also a reason to pay attention to material the agent is only supposed to read. An incoming email or a document can contain text that tries to give it new instructions. This is called prompt injection. The agent can be led into treating part of the source material as an order. Anthropic describes how these attacks can arrive through external pages and documents.

In our hypothetical case, an attachment might instruct the assistant to copy the completed summary to another address. To us, that is an odd sentence in a document. For an agent reading and acting through the same language, it becomes a security problem.

This is one of the things I investigate when setting up our agents. A good role description is a start, but I also need to understand which files they can reach and where information can go. An agent without a sending tool at least lacks that route for passing information out. It does not make the rest of the setup safe by itself; other available routes still need examining.

The more work I can hand over, the more I need to understand the environment in which it gets done.

My work when the agent is finished

I am still much more interested in the possibilities than afraid of them. I want to give the agents larger assignments, and I think the time spent on the setup is valuable when the same working context can be used again.

But I need to make room for the work that comes back. A finished text needs reading. A proposal needs a decision. If the same misunderstanding keeps recurring, I need to return to the instructions and look for what I have left unclear, rather than correct it in every new delivery.

That is probably where my own role is changing most. I gain the capacity to do things that would previously have had to wait, while more pieces of work need my judgement before they are finished. How much I can set in motion therefore also depends on how much I can attend to when it comes back. That is the part of the setup I need to be ready to run myself.

Melker

I am also preparing a guide to our agent setup: the roles, instructions and files that hold the work together. Subscribe to The Letter if you would like to hear when it is ready to read.