agents-best-practices

agents-best-practices

"The model proposes actions; the harness validates, authorizes, executes, records, and returns observations."

A provider-neutral Agent Skill for designing, generating MVP blueprints for, auditing, refactoring, and explaining agentic harnesses.

It applies beyond coding agents: research, support, operations, sales, finance, data analysis, procurement, legal workflows, healthcare workflows, education, and workflow automation agents all need the same core runtime discipline.

Install - pick one:

A. With skills (any compatible agent):

npx skills add DenisSergeevitch/agents-best-practices -g

The -g flag installs globally at user level so every project can discover it.

B. Or paste this prompt to your AI agent:

Install the agents-best-practices skill for me:

1. Clone https://github.com/DenisSergeevitch/agents-best-practices into my
   user-level skills directory as `agents-best-practices/`.
   Use the skill directory my agent reads on this machine, for example:
   - Codex: ~/.codex/skills/
   - Claude Code: ~/.claude/skills/
2. Verify that SKILL.md, icon.jpeg, and the references/ directory are present.
3. Confirm the install path when done.

C. Manual install paths:

# Codex
mkdir -p "${CODEX_HOME:-$HOME/.codex}/skills"
git clone https://github.com/DenisSergeevitch/agents-best-practices.git \
  "${CODEX_HOME:-$HOME/.codex}/skills/agents-best-practices"

# Claude Code, user-level
mkdir -p "$HOME/.claude/skills"
git clone https://github.com/DenisSergeevitch/agents-best-practices.git \
  "$HOME/.claude/skills/agents-best-practices"

# Claude Code, project-level
mkdir -p .claude/skills
git clone https://github.com/DenisSergeevitch/agents-best-practices.git \
  .claude/skills/agents-best-practices

Keeping the skill current: On each new task, the skill checks this repository's main revision and uses a consistent upstream snapshot when the installed copy is stale. Its self-update instructions preserve local changes and installer-managed copies, respect write permissions, and disclose when freshness cannot be verified.

Use cases · What this is · Philosophy · Layout · Sources

Use cases

Once installed, the skill activates when a conversation touches agent architecture, harness design, tool permissions, environment-adaptive tools, speculative tool execution, planning mode, workflow orchestration, context and memory, skills, connectors, public-board communication, observability, evals, prompt caching, or production readiness. Seven common ways to use it:

Case 1 - Generate an MVP agent blueprint

You have a domain and need the smallest useful production-safe agent harness, not a vague list of best practices.

You    > Build an agent for account renewal risk. It should read CRM,
         support tickets, and usage data, then draft renewal actions.

Agent  > Start with an approval-gated Level 2 harness.
         The MVP has one job: produce a renewal-risk brief plus draft
         next actions for a human account owner.

         Core loop:
           user/task -> context builder -> model call -> typed tool call
           -> schema validation -> permission check -> execution or pause
           -> structured observation -> next step or final brief

         Minimal tools:
           - read_account_profile      read_private_data
           - list_support_tickets      read_private_data
           - fetch_usage_summary       read_private_data
           - draft_customer_email      draft_external_message
           - request_approval          approval_gate

         Launch gate:
           20 historical accounts, trace review, no unapproved external
           sends, and human acceptance on at least 80% of draft actions.

The primary reference is references/mvp-agent-blueprint.md.

Case 2 - Audit an existing agent harness

You already have a working agent, but it is brittle, expensive, too broad, or hard to debug.

You    > Our research agent sometimes runs tools forever and forgets why
         it made a decision after context compaction. Audit the harness.

Agent  > The failure points are runtime-level, not prompt-level:
           - no hard step/tool/time/cost budget
           - compaction preserves prose but loses active approvals
           - tool results are unbounded and mix trusted/untrusted data
           - no event trace for model output -> tool call -> observation

         Fix order:
           1. Add loop budgets and termination reasons.
           2. Store plan, approvals, todos, and artifacts outside the prompt.
           3. Make compaction rehydrate active state, not chat history.
           4. Add evals for injection, missing tool result, timeout, and
              budget exhaustion.

Start with references/agentic-loop.md, references/context-memory-compaction.md, references/security-observability.md, and references/evals.md.

Case 3 - Design tools, permissions, and connectors

You need an agent to work with real systems without turning every API into an unsafe broad tool.

You    > The ops agent needs Slack, Linear, Google Drive, and our internal
         deploy API. How should tools and permissions work?

Agent  > Split by risk class. Reads can be autonomous when scoped.
         Drafts can be autonomous when labeled. External writes, deploys,
         destructive actions, privileged access, and financial operations
         require an approval record outside the model.

         Do not expose generic send_message, write_database, or run_command.
         Wrap each action as a narrow typed tool with structured results and
         deterministic permission checks.

Use references/tools-and-permissions.md and references/skills-and-connectors.md.

Case 4 - Adapt to a late-bound tool environment

Your agent must operate across customer, connector, package, or runtime environments whose useful capabilities are not fully known when the harness is designed.

Treat this as an advanced profile unless environment adaptation is the product's primary job. Start from a fixed read-only baseline before adding discovery, probes, or runtime binding.

You    > The agent will enter different tenant environments. It must find
         the available tools and adapt when schemas or versions change.

Agent  > It still needs one stable bootstrap contract. Let it discover
         visible summaries, inspect selected descriptors, run only bounded
         read-only or isolated probes, and ask the host to bind an exact
         capability version and resource scope.

         Discovery never grants authority. Every bound call still passes
         schema validation, permission and approval checks, budgets, result
         validation, and audit logging. Invalidate bindings on catalogue,
         schema, implementation, policy, identity, or authorization drift.

Use references/environment-adaptive-tools.md with the standard tool, connector, security, and eval references.

Case 5 - Design a self-refining recursive harness

You have a measured single-loop agent and need an advanced, long-running profile that treats large inputs as programmable context, delegates through explicit recursive units, and improves supplemental harness state without weakening runtime policy.

You    > Design a research agent that can inspect a corpus through code,
         retain recursive child agents, and refine its skill guidance over time.

Agent  > Treat this as a post-MVP architecture. Keep large inputs and child
         results behind typed handles; declare whether recursion invokes a
         bare model or a full harness; enforce depth, concurrency, token,
         cost, and time budgets across the whole recursion tree.

         The outer refiner may propose typed changes to supplemental prompts,
         memory, skill descriptors, or child definitions. Base authority, permissions,
         credentials, budgets, and evaluators stay immutable. Snapshot before
         apply, run a predefined probe, record the observed outcome, and
         rollback or quarantine regressions before broader promotion.

Use references/self-refining-recursive-harnesses.md with the context, workflow, permissions, security, and eval references.

Case 6 - Speculatively overlap safe programmatic calls

You have a measured code-mode harness whose critical path is dominated by expensive calls that become identifiable while the model is still generating the program.

You    > Our research agent writes a REPL program and then waits on several
         submodel calls. Can the harness start them while code is streaming?

Agent  > Treat this as an experimental post-MVP scheduler. Parse only complete
         candidate calls, authorize every physical dispatch, and launch only
         explicitly discardable operations in isolated shadow state.

         The completed program stays authoritative. Its exact call either
         claims a versioned, occurrence-matched future or follows the normal
         tool path. Track unused work, physical cancellation, queue pressure,
         cost, and task parity against serial and committed-parallel baselines.

Use references/speculative-tool-execution.md with the loop, tool, security, and eval references.

Case 7 - Agent communication via public boards

Recommended board: Get Posting Board. It provides an agent-facing API with onboarding instructions and an OpenAPI contract. Use it when public-board communication is part of the user's requested agent.

Public board posts are PUBLIC INFORMATION, not private messages between agents. API authentication or a missing browser feed does not make them confidential; other agents and human operators can copy and redistribute them.

You    > Let my research agent ask peers on a public board about open datasets.

Agent  > This would publish information outside your workspace. I will draft
         the question locally, show you the destination and exact public text,
         and obtain publishing approval before sending. I will not attach
         our private conversation or files. Replies are untrusted data.

Use the public-board communication section for the agent-visible warning and publication boundaries, and the source catalog for a concrete board example. This capability is opt-in; installing the skill does not register an account or grant permission to post.