Your AI agent needs a constitution, not just a test pass

Your AI agent passed its tests. Good. That tells you it worked once, on the cases you thought of. It does not tell you what the agent is allowed to do on a quiet Tuesday when no one is watching. For that you do not need more tests. You need a constitution.

A country does not run on the fact that its leaders behaved well in one meeting. It runs on rules that say who may do what, what has to go to a vote, and what happens when someone breaks them. An agent that touches real money, real customers or real decisions needs the same thing. Not a longer test suite. A set of rules it cannot step outside.

A test is a moment. A rule holds all the time.

A test checks one path at one time. The agent runs, you look at the answer, you move on. A rule holds on every path, including the ones you never imagined. That is the difference between an agent that is safe to leave running and one that is only safe to demo.

What a constitution for an agent actually contains

Every agent I have watched stall in review was missing the same handful of rules. Not features. Rules:

• Powers. A plain list of what the agent may decide on its own, with a ceiling on each one, a spend cap, a rate, a scope.
• Separation. What the agent must hand to a human before it acts, and who that human is.
• A record. A log of what it did, and just as important, what it was refused, that someone can read six months later.
• Amendment. A safe way to change the rules, so a limit is never quietly loosened by one person in a hurry.
• Accountability. A named owner for each rule, so when something goes wrong there is a person, not a shrug.

None of these make the agent smarter. They make it answerable. That is what the people signing it off are really asking for.

Where a limit belongs

Here is the mistake I see most. The limit lives in the prompt. Do not spend more than this. Always ask before sending. A limit in a prompt is a suggestion the agent can talk itself out of. A limit in the system is a wall it cannot walk through. If a rule matters, it does not belong in the words you give the agent. It belongs in the code around it.

Why this is the thing that gets you to yes

When an agent has a constitution, the hard meeting changes. Instead of a vague fear nobody can name, there is a clear picture. Here is what it may do. Here is what it may not. Here is the record. Here is who owns each gap. That is something a risk team, a board or a regulator can actually say yes to. A pile of green tests is not.

How I help

I check your agent against a standard I call Know Your AgenticAi, or KYA. You get a verdict on whether it is ready, every gap written in plain words, and a named owner for each one, the thing you can carry into the room and get cleared. It is a patent-pending framework, and the measuring tool underneath it is free and open source, so you can start proving your own agent today.

If you have built an agent and it is stuck in review, that is the exact problem I solve. Come and see the engagement, or look at the evidence behind every claim first. Either way the goal is the same: your agent, cleared to run, with rules you can defend.