Your operations assistant clears a queue of synthetic tickets without a wrong move: refunds, password resets, an address change. So you let it take internal requests, where nothing it does is irreversible, and it holds there too. Then it gets a slice of the real queue, and within a day refused actions are climbing and two runs have stalled against a billing system too slow to wait for. The model did not change between those stages. The prompt is the same prompt. Everything around it is different, and that is the part a rollout was built to test.

A first day at nursery lasts an hour

No nursery takes a child for a full day on the first morning. The first visit is an hour with the parent still in the room, and nothing about it is real: the child is not being left, only shown the place. Then a short session with the parent gone but reachable, close enough that a bad half hour ends with somebody walking back through the door. Only after that comes a morning with the hard parts in it: lunch, the nap, the handover. Each step has something written down that decides whether the next one happens — did they eat, how long did the crying last, did they sleep at all — and a bad week moves the plan back a step. Nobody calls that failure. Going back is what makes going forward safe.

An agent gets promoted the same way. It starts in an isolated environment on fixtures, where a wrong action costs nothing because nothing it touches is real. It moves to controlled tasks or internal requests, where a person nearby can still undo the effects. Only then does it see a fraction of live traffic, and it goes wider only while the metrics and the reviews stay inside the range you set beforehand. A rise in errors, or in actions the permission layer refuses, stops the promotion and puts it back where it came from.

What blocks you is rarely the model

The thing that breaks at the live-traffic stage is almost never the reasoning. It is the integrations: a real API that answers slowly, a field that changed shape last quarter, a payload nobody had seen degraded. So you inventory them before you widen anything and put them behind typed interfaces, so a slow answer is a handled case and not a surprise. You build evaluation sets that are representative and also adversarial, because the run that hurts you is the strange one. You set thresholds and let them page somebody. And you write down who owns quality, who owns incidents, who owns the morning a model alias moves underneath you. Ownership defined after the first incident is just a name attached to blame.

The rest of readiness is composition, not capability. An agent is ready because its layers hold together, not because it wrote good code in a demo, and each layer earns its tick by being made to work once in front of you. Kill a run halfway and watch it resume from its checkpoint. Switch modes and confirm the tool manifest actually shrinks, so the read-only agent cannot see the refund tool at all. Type something while it is streaming and see it stop. Look at the money while the run is going, not at the end of the month. And keep the task narrow until the numbers hold, because nobody moves a child to a new room the same week they drop the bottle: change two things at once and you lose the ability to say which one moved the number.

The incident comes back as a test

The last stage is not an end but the start of a loop. An alert opens an investigation with logs, metrics and the last deploy attached. The agent assembles a root cause and a proposed patch, a reviewer approves the action, and the postmortem produces two things that outlive it: a regression test, and a line in the runbook. That is how an incident stops being a memory and becomes part of the product — and it is the defence against the failure mode of scale, where errors too rare to notice in a pilot turn into quiet incidents once the volume arrives.

None of this is new. Software has been earning its way into production in stages for decades, and the only thing agents changed is how badly people want to believe they are the exception. They are not, and the reason is plain enough by now: what you promote was never the model. It is everything you built around it.