---
title: "AI Agent Spec: Five Things to Write Down Before You Build"
description: "Five cells to fill in before building an AI agent, matched to the SOP managers write, with an invented example and when a workflow beats an agent."
url: "https://staging.khoi.co.uk/en/blog/nam-nguyen-lieu-cua-ai-agent"
lang: en-GB
author: "Lê Quốc Khôi"
date: 2026-11-03
updated: 2026-11-03
topics: ["AI for leaders"]
tags: ["AI agents", "Delegating to AI", "Operating procedures", "Context for AI"]
---

# Five things to specify before you build an AI agent

## Key takeaways

- Anthropic separates workflows, where models and tools run along predefined code paths, from agents, where the model directs its own process and tool use (Anthropic, 2024). A process with fixed steps usually does not need an agent yet.
- Five cells to write down before building an agent: role and instructions, inputs, memory, tools, boundaries and stopping points. The split is this site's; OpenAI names only three components, model, tools and instructions (OpenAI, 2025).
- "An agent is an SOP that can run" is the site's metaphor, and no source says it. It breaks at one point: an SOP fixes the steps, an agent chooses them.
- If a cell cannot be filled in, do not build yet. Agents cost more and errors can compound (Anthropic, 2024).

Suppose a supplier's invoice says 480 cartons, the purchase order says 400, and the warehouse booked in 420. Suppose a vendor offers your finance director an AI agent to settle that for every invoice, "live in four weeks". The pitch has a diagram and a model name but nothing on what the agent may do when the three numbers disagree. Five questions come before any signature, and anyone who has written a standard operating procedure (SOP) for a new hire can already answer them.

## What is an AI agent, and why read it as a procedure?

Anthropic defines an agent as a system in which the model directs its own process and tool use, and a workflow as one that orchestrates models and tools along predefined code paths (Anthropic, 2024). OpenAI likewise leaves simple chatbots and sentiment classifiers outside the category, because they do not control how a workflow runs (OpenAI, 2025). See [AI agent](https://staging.khoi.co.uk/en/glossary#ai-agent) and [LLM workflow](https://staging.khoi.co.uk/en/glossary#llm-workflow).

I call an agent "an SOP that can run" because an SOP answers three questions anyone handing out work must settle: who does what, with which means, and where they stop. The phrase is the site's metaphor, and no source uses it.

## What are the five things to specify for an AI agent?

Role and instructions, inputs, memory, tools, and boundaries and stopping points. Each matches something managers already write for people, and [Five things to specify for an agent](https://staging.khoi.co.uk/en/framework/agent-primitives) gathers them into one specification.

> **Figure:** [Five things to specify for an agent](https://staging.khoi.co.uk/en/framework/agent-primitives) The five cells of an agent specification, as grouped by this site.

| Cell | What you already write for people | What the sources say |
|:--|:--|:--|
| Role and instructions | Job description, step-by-step procedure | Build on existing operating procedures, one specific action per step, branches for edge cases (OpenAI, 2025) |
| Inputs | The trigger: who hands over work, and how | An agent starts from a command or a conversation with the user (Anthropic, 2024) |
| Memory | Handover note, processing log | Notes kept outside the context window and pulled back later (Anthropic, 2025) |
| Tools | System access rights: view only, or edit | Data, action and orchestration tools (OpenAI, 2025) |
| Boundaries and stopping points | Approval limits, escalation rules | A maximum number of iterations, pauses for human feedback (Anthropic, 2024); hand back to a person at failure thresholds or for high-risk actions (OpenAI, 2025) |

One more point on tools. Anthropic (2025) lists bloated tool sets, or ones that leave it ambiguous which tool applies, among the most common failure modes it sees; if a human engineer cannot say which tool fits, an agent cannot be expected to do better (Anthropic, 2025).

## What does a filled-in card look like for invoice matching?

"Phân Phối Mẫu" is an invented distributor, and so is every figure and threshold below: 40 suppliers, 600 invoices a month, and two accountants spending the last three days of each month comparing invoices with purchase orders (POs) and goods-received notes. Whether the task should go to AI at all is the question of the post on [which tasks to hand to AI](https://staging.khoi.co.uk/en/blog/viec-nao-giao-cho-ai); here I assume yes.

1. Role and instructions: an assistant for accounts payable. The instructions come from the firm's existing matching SOP, one action per step: read the invoice for the PO number and line items, look up the PO and goods-received note, compare item, quantity and unit price, record "match" or "mismatch" with a reason. Exceptions are written out: no PO number, partial deliveries, foreign-currency invoices. Assumed tolerance: a unit price within 0.5% counts as a match.
2. Inputs: an accountant drops a batch of PDF invoices in a shared folder and types "match the November batch". No schedule in version one; running on an event, like a [trigger](https://staging.khoi.co.uk/en/glossary#trigger) in ordinary automation, comes later.
3. Memory: two files. A processing log, one line per invoice with number, result and reason. A supplier-notes file, for example "supplier B quotes unit prices including VAT". The agent reads the notes at the start of each batch and proposes new lines; the chief accountant approves them before they enter the file (the approval step is my own choice).
4. Tools: five, none overlapping. Three read-only data tools: read an invoice PDF, look up a PO, look up a goods-received note. Two action tools: add a line to the log, and draft an email query to a supplier (a draft, never sent). No access to the payment system. OpenAI suggests rating each tool low, medium or high risk by whether it only reads or can write, whether it is reversible, and its financial impact (OpenAI, 2025); all five here are read-only or reversible.
5. Boundaries and stopping points: at most 20 steps per invoice, then hand over to a person (Anthropic, 2024). Three failed attempts to read an invoice, hand over; a difference above VND 5m or a supplier not yet in the notes, pause for the chief accountant. Those two follow OpenAI's triggers for human intervention, failure thresholds and high-risk actions (OpenAI, 2025). The agent does not approve payments, email outside the firm or edit POs. Before a live run, test on last month's batch, which people have already answered, with no connection to live systems (Anthropic, 2024). The error to fear most: "match" on a line a person marked "mismatch".

## What if a cell cannot be filled in?

Do not build yet. An empty cell is a question nobody has answered, and the technical team will answer it for you with an assumption you never see.

Suppose nobody at Phân Phối Mẫu can answer cell 5: who decides when the difference exceeds VND 5m, and who covers when the chief accountant is on leave? The first job is to write the escalation rule, which would help the human staff today, not to buy an agent. The library's framework records a trap in this cell: writing "the agent decides" without the stopping points. Anthropic says agents cost more and can compound errors, so they need testing in sandboxed environments with suitable [guardrails](https://staging.khoi.co.uk/en/glossary#guardrail) (Anthropic, 2024). OpenAI stresses [human intervention](https://staging.khoi.co.uk/en/glossary#human-in-the-loop), especially early in deployment (OpenAI, 2025).

## When is a workflow enough, with no agent needed?

When the steps are known in advance and repeat. Anthropic advises finding the simplest solution possible and adding complexity only when needed, which may mean not building an agentic system at all; for many applications a single optimised model call with retrieval and examples is usually enough (Anthropic, 2024).

> **Figure:** [Workflows versus agents](https://staging.khoi.co.uk/en/framework/workflows-vs-agents) Workflows and agents as Anthropic (2024) distinguishes them. Laying them out as a comparison table is this site's choice.

Apply that to the example. Reading, looking up, comparing and recording are known steps, so on Anthropic's split this is a workflow: code runs a fixed path and the model only reads the PDF and extracts fields. An agent earns a place only where the work is open: a mismatch of unknown cause (short delivery, price change or typing error?) where someone must choose between checking the contract and asking the buyer. OpenAI lists three signs that an agent may be worth considering: complex judgement and exceptions, rules that have become hard to maintain, and heavy reliance on unstructured data (OpenAI, 2025). A PDF invoice is unstructured data; the line comparison is not.

So I would build the workflow first, measure how many mismatches land in "cause unknown", and add an agent only if that pile is big enough, since Anthropic says to add complexity only when it demonstrably improves outcomes (Anthropic, 2024). That sequence is my inference, not a recommendation either source makes for this case.

## Where does "an SOP that can run" break down?

On who chooses the steps. An SOP fixes the order before anyone runs it; an agent, in Anthropic's words, keeps control over how it accomplishes the task (Anthropic, 2024). Its instructions therefore look more like an SOP written at the "right altitude" than a list of commands. Anthropic (2025) names two extremes: hard-coding brittle logic into the prompt, and vague high-level guidance that wrongly assumes shared context (Anthropic, 2025).

Two more differences are my own observations, not findings of the sources. A human colleague takes yesterday home; after a context reset an agent only rereads its own notes (Anthropic, 2025). And accountability stays with a person: an SOP has someone who signed it off, and a specification card needs a signatory too.

## Going deeper: what are the sources, and where do the five cells come from?

All three sources are written by AI vendors for their customers and engineering teams; none is independent research. Anthropic (2024), published on 19 December 2024, says it worked with dozens of teams building agents and found that successful implementations used simple, composable patterns (Anthropic, 2024). OpenAI (2025) is a PDF guide that says it distils lessons from numerous customer deployments (OpenAI, 2025). Anthropic (2025), published on 29 September 2025, is a post on context management for agents (Anthropic, 2025).

None of the three gives figures for what agents cost or how errors compound, or tests whether filling in a five-cell card produces better results. The 15 and 10 tools are OpenAI's account of "some implementations", not a survey (OpenAI, 2025).

The five cells are this site's grouping of the three sources. OpenAI names three core components: model, tools and instructions (OpenAI, 2025). Anthropic (2024) treats the basic building block as a model augmented with retrieval, tools and memory (Anthropic, 2024). Splitting out role, inputs, memory and boundaries, and the workflow-versus-agent table, are the site's own way of dividing them. The card leaves out "model", a job for the technical team. The two vendors use "workflow" differently; this post follows Anthropic.

The post does not examine the pages Anthropic links to or either company's SDK documentation. The OpenAI guide is used as a text extraction of the PDF, without close study of its code listings and multi-agent patterns; the library gives it no page numbers, so it is cited by section. The "Phân Phối Mẫu" card is a paper exercise: no agent has been built or run for it, and every threshold is invented.

## Frequently asked questions

### How is an AI agent different from a chatbot or a workflow?

Anthropic says a workflow runs along code paths fixed in advance, while an agent directs its own process and tool use (Anthropic, 2024). OpenAI leaves simple chatbots, single-turn models and sentiment classifiers outside the agent category, because they do not use the model to control how a workflow runs (OpenAI, 2025). A product sold as an "agent" can be either kind depending on the vendor's definition, so ask who decides the order of the steps.

### Should I build one agent or several?

OpenAI advises getting the most out of a single agent first, since more agents add complexity and overhead. It names two signs that it is time to split: the agent fails to follow complicated instructions, or it keeps picking the wrong tool. On tools, the issue is overlap rather than count alone: some implementations manage more than 15 well-defined tools, while others struggle with fewer than 10 overlapping ones (OpenAI, 2025).

### Are guardrails enough to make an agent safe to run?

Not on their own. OpenAI writes that a single guardrail is unlikely to give sufficient protection, so it recommends several specialised ones layered together, coupled with authentication, authorisation and strict access controls as in ordinary software (OpenAI, 2025). In the specification card, that means the tools cell (access rights) and the boundaries cell have to be filled in together.

### Do sources from 2024 and 2025 still hold?

Anthropic's December 2024 post carries its own note that much of the tooling it describes has changed since then (Anthropic, 2024). Take the questions from the sources rather than the product names: who chooses the steps, what the agent remembers, what it can touch, where it stops. Those questions do not depend on any particular tool.

## References

- Anthropic (2024) *Building effective AI agents*. Anthropic Research. Available at: https://www.anthropic.com/research/building-effective-agents (Accessed: 2026-11-01).
- Anthropic (2025) *Effective context engineering for AI agents*. Anthropic Research. Available at: https://www.anthropic.com/research/effective-context-engineering-for-ai-agents (Accessed: 2026-11-01).
- OpenAI (2025) *A practical guide to building agents [guide]*. Available at: https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf (Accessed: 2 November 2026).

---

Canonical HTML version: https://staging.khoi.co.uk/en/blog/nam-nguyen-lieu-cua-ai-agent