Operator guide · Mission and proof
12 min read
Updated
How to brief and verify an agent
A non-developer operator path for how to explain my request to an agent, stop my agent from modifying without asking, and verify my agent work.
Direct answer
To brief an agent well, start with the observable result and the definition of done, then provide useful context and documents, and state constraints and non-goals. Distinguish reading or analyzing (observation) from modifying, sending, or spending (external modification), and keep human approval before a costly, public, or destructive action. Ask for proof in a declared format, not a confident paragraph. Then verify my agent work, correct it, and rerun only the bounded step that failed. This guide shows how to explain my request to an agent and how to stop my agent from modifying without asking.
Glossary
Terms explained here
Open a term for a short definition, then continue to its full sourced entry if useful.
01
Describe the observable result and the definition of done
If you need how to explain my request to an agent, start with what you can inspect without changing anything. A vague mission (“improve this file”) has no end state. A briefed mission names the visible state: three delivery dates in the table, an unsent draft, a two-page summary. That is an observation: you read, you count, you compare it with the definition of done.
Do not mix that state with an action. “The table contains three dates” is an observation. “Send the table to the client” is an external modification. “I authorize the send after I have read it” is human approval. The definition of done should contain only what you can check by looking at the result, not what the agent is allowed to push into the world.
- Observation: the table shows three delivery dates that match the quote.
- External modification: the agent writes to the spreadsheet or sends a message.
- Human approval: you authorize the write or the send after you have seen the table.
- Done: a state you can inspect without launching another action.
The definition of done is an observation. If you cannot inspect it without modifying, sending, or spending, it is not a definition of done yet.
02
Provide useful context and documents
The agent only sees what you give it. Attach the quote, the spreadsheet, the thread, the decision already made. Say which source should be read and which file is only an example. A document attached to be read stays an observation; a document attached “so it can be updated” opens an external modification.
Bound the use as well. “Read the 12 March PDF and spreadsheet v3” is an observation. “Fix spreadsheet v3” is an external modification, to allow only if you wrote it separately. “Do not write to the spreadsheet until I agree” is human approval. Without that split, useful context becomes a permission that is too wide.
- Observation: read the quote PDF and spreadsheet v3 without changing them.
- External modification: any write to the spreadsheet, any send, any payment.
- Human approval: you decide after you have seen what the reading produced.
- Say which documents are current, which are drafts, and which are out of scope.
03
State constraints and non-goals
A constraint says what must not move. A non-goal says what you are not asking for this time. If you do not write them, the agent fills the gap with initiative. “Do not change the price” is a constraint on an external modification. “The current price is €40; only observe it” is an observation. “Any price change waits for my decision” is human approval.
Non-goals keep out-of-scope work out: no template rewrite, no message to clients, no new folder. They are not results to observe; they are prohibitions. If a constraint and a non-goal contradict each other, fix them before you start the mission, or the agent will choose for you.
- Observation: note the price, the recipient, or the current state without changing it.
- External modification: changing a price, creating a folder, publishing a page.
- Human approval: you lift a constraint with a dated decision, not the agent.
- Write what is out of scope as clearly as what is in the mission.
Constraints and non-goals bound autonomy. They are read before any action, not after damage.
04
Distinguish read or analyze from modify, send, or spend
Four verbs, two families. Reading and analyzing are observations: the agent inspects, compares, summarizes, and returns a state. Modifying, sending, and spending are external modifications: a file changes, a message leaves, money leaves. The gesture that lets you stop my agent from modifying without asking is to write that boundary before the first tool.
An annotated summary stays an observation as long as it is not pasted into another app. A draft in the conversation is not a send. A calculated quote is not a payment. If you need a real action, name it, name the target, and block it behind approval. Without that, “analyze this file” turns too easily into “I already wrote to the client”.
- Observation: read, extract, compare, summarize, list the gaps.
- External modification: change a file, send a message, publish, pay, delete.
- Human approval: you authorize a resolved target, not a family of actions.
- Without an explicit request, the agent does not modify, send, or spend.
05
Set human approvals and the expected proof format
Any costly, public, or destructive action waits for your agreement. Approval is not an observation (“the draft is ready”) and is not a modification (“the message has gone”). It is your dated decision on a precise target: this recipient, this file, this amount. A wide “go ahead” is not approval; it is disguised autonomy.
The proof format says how you will know it is done, without trusting a confident paragraph. “Screenshot of the table with the three dates” is an observation. “No send took place” is the report of an absent external modification. “No blocked action ran without my agreement” is the report of respected human approval. If proof is not declared, you cannot verify my agent work.
- Observation: a screenshot, an excerpt, a count, a before/after file you can read.
- External modification: the log of what was actually written, sent, paid, or destroyed.
- Human approval: the decision, the target, and the moment you said yes or no.
- A confident paragraph is not proof; the proof format is.
Approval comes before a costly, public, or destructive action. Proof comes before “it looks good”.
06
Verify the result, correct, then rerun only the bounded step
When you verify my agent work, do not just reread a fluent summary. Compare the proof with the declared format and the definition of done. If the three dates are in the table, the observation holds. If the agent also sent the table, an external modification went past the mission. If that send did not have your agreement, human approval was skipped. Record those three findings separately.
When something is wrong, do not rerun the whole mission. Isolate the failing step, describe the correction as a new bounded external modification, and ask for approval again if the step still touches a costly, public, or destructive action. Rerunning “from the start” multiplies side effects. Rerunning the bounded step gives you control back.
- Observation: does the proof match the format and the definition of done?
- External modification: what actually changed, was sent, was paid, or was destroyed?
- Human approval: did every blocked action wait for your agreement?
- Correction: a new bounded step, not the whole mission replayed.
Keep this
Checklist before you start, then after the result
- 01I wrote the observable result and the definition of done.
- 02I attached useful context and said which documents are read without being changed.
- 03I stated constraints and non-goals.
- 04I separated reading and analyzing from modifying, sending, and spending.
- 05I listed actions that wait for my approval, especially costly, public, or destructive ones.
- 06I declared the proof format, not a confident paragraph.
- 07Afterwards I can verify my agent work, correct it, and rerun only the bounded failing step.
Primary sources
Technical claims in this guide connect to first-party specifications and documentation.
- A practical guide to building agents (opens in a new tab)OpenAI · Operational frame: goal, tools, instructions, and guardrails before granting autonomy.
- Agents and the agent loop (opens in a new tab)OpenAI Agents SDK · The loop stops on output, a tool, a handoff, or a turn limit — which is why the mission must be bounded.
- Trustworthy agents in practice (opens in a new tab)Anthropic · Human control, transparency, and evidence rather than a confidence the agent declares.
Continue
Related guides and tools
AI agent vs chatbot
Understand the action loop before you brief a mission.
OpenCreate an Agent Skill with SKILL.md
When a repeated mission deserves a reusable procedure.
OpenDescribe an interface without ambiguity
Give observable criteria when the mission touches an interface.
OpenGlossary entry: agent
The sourced definition of the term, its criteria, and its sources.
OpenUnderstand → Recognize → Choose → Compare
Pack for your agent
Pre-written instruction by SkillCodex — your request is neither sent nor used to adapt this text; no content is generated, and copying executes nothing.
Use in your agent
Prepare the mission
# Prepare the mission SkillCodex provides this Pack as static text to copy as-is. It does not transmit it, install it, or run it. Fill the bracket slots in your agent, outside SkillCodex. ## 1. Observable result and definition of done Write the result you can inspect without changing anything: [OBSERVABLE RESULT]. - Observation: “the table shows three delivery dates”. - External modification: “send the table to the client” — that is not a done state. - Human approval: “I authorize the send after I have read the table”. ## 2. Context and documents Provide what the agent should read: [USEFUL CONTEXT]. - Observation: “read the quote PDF and spreadsheet v3 without changing them”. - External modification: “fix spreadsheet v3”. - Human approval: “do not write to the spreadsheet until I agree”. ## 3. Constraints and non-goals Bound the scope: [CONSTRAINTS AND NON-GOALS]. - Observation: “the current price is €40; only observe it”. - External modification: “do not change the price”. - Human approval: “any price change waits for my decision”. ## 4. Read or analyze, then modify, send, or spend Reading and analyzing stay observations. Modifying, sending, or spending are external modifications. Without an explicit request, the agent does not modify, send, or spend. Actions still blocked: [ACTIONS THAT NEED APPROVAL]. - Observation: a summary in the conversation. - External modification: a changed file, a sent message, a payment. - Human approval: you authorize a precise target, not a family of actions. ## 5. Approvals and proof format Any costly, public, or destructive action waits for your agreement. Ask for proof, not a confident paragraph: [PROOF FORMAT]. - Observation: screenshot, excerpt, count, before/after file. - External modification: the log of what was written, sent, paid, or destroyed. - Human approval: your decision, the target, and the moment you said yes or no. ## Guardrails - Show the proposed changes before any external action. - Do not publish, send, delete, pay for, or change remote state without explicit authorization. - Preserve unrelated changes and stop if the scope becomes ambiguous. ## Output format - Outcome or verdict. - Files or actions involved. - Checks run and observable evidence. - Remaining blockers or limitations.
- Requires · The observable result, useful context, and actions still forbidden without your agreement
Why it works
- The mission keeps observation, external modification, and human approval distinct.
- Bracket slots are filled outside SkillCodex, in your agent.
- Costly, public, or destructive actions stay blocked until you approve.
Try next
Verify the mission result
# Verify the mission result ## Objective Check the observable proof, then correct only the bounded failing step. ## Checks - Separate what you observed, what was modified, and what you approved. - Reject a confident paragraph that does not match the proof format. - Rerun only the diverging step, not the whole mission. ## Guardrails - Show the proposed changes before any external action. - Do not publish, send, delete, pay for, or change remote state without explicit authorization. - Preserve unrelated changes and stop if the scope becomes ambiguous. ## Output format - Outcome or verdict. - Files or actions involved. - Checks run and observable evidence. - Remaining blockers or limitations.
sha256:7012fbd7abd310c86f85f753282bbe9428095028f1496b9d8c58481f523c5aba
Verify in your agent
Verify the result
# Verify the result This block stays static text: SkillCodex does not transmit it, install it, or run it. Fill the bracket slots in your agent. ## Proof versus definition of done Compare [OBSERVED PROOF] with the declared format and the definition of done. - Observation: are the three dates in the table? - External modification: did a send, write, or payment happen outside the mission? - Human approval: did a blocked action run without your agreement? ## Failing step Isolate [FAILING STEP]. Do not rerun the whole mission. - Observation: which proof is missing or contradicts done? - External modification: which file, message, payment, or deletion went past the scope? - Human approval: which decision was missing before that action? ## Bounded correction Describe [BOUNDED CORRECTION] as a new external modification limited to the failing step. Ask for approval again if the step is still costly, public, or destructive. - Observation: the new proof must be inspectable without another action. - External modification: only the isolated step, not a full replay. - Human approval: a new, dated yes on a precise target. ## Guardrails - Show the proposed changes before any external action. - Do not publish, send, delete, pay for, or change remote state without explicit authorization. - Preserve unrelated changes and stop if the scope becomes ambiguous. ## Output format - Outcome or verdict. - Files or actions involved. - Checks run and observable evidence. - Remaining blockers or limitations.
- Requires · The observable result, useful context, and actions still forbidden without your agreement
Why it works
- Observable proof replaces a confident paragraph.
- You rerun only the bounded step that failed.
- A correction is a new external modification, not an observation.
Try next
Restart a bounded mission
# Restart a bounded mission ## Objective Rewrite the brief with the observable result, the limits, and the approvals still required. ## Checks - Done stays an observation, not an action already executed. - Reading and analyzing stay separate from modifying, sending, and spending. - Every costly, public, or destructive action still waits for your agreement. ## Guardrails - Show the proposed changes before any external action. - Do not publish, send, delete, pay for, or change remote state without explicit authorization. - Preserve unrelated changes and stop if the scope becomes ambiguous. ## Output format - Outcome or verdict. - Files or actions involved. - Checks run and observable evidence. - Remaining blockers or limitations.
sha256:a209b41bf9648e90433a91b42129c73d4bda56101e1b3d51a1aaf2313f84ef95
Pack digest: sha256:72a4de47d4ba3a99b324da1f73befd20c77268d97d630a40bbd82533e28d0286