Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Build a production-shaped agent for a real task (a research assistant, a coding helper, a data agent). Deliver: (1) a robust loop with retries/fallbacks for tool failures, validated (schema'd) outputs, and a clear stopping condition; (2) GUARDRAILS — least-privilege tools (allowlist), HUMAN-IN-THE-LOOP approval before any risky/irreversible action, sandboxed execution, and hard SPEND + iteration caps; (3) explicit PROMPT-INJECTION defense — treat all tool/retrieved content as untrusted and constrain capabilities accordingly; (4) at least one tool exposed or consumed via MCP (or a clear justification); (5) COST/LATENCY control (cheaper models for sub-tasks, caching, parallel tool calls); and (6) an EVAL SET + tracing. Document why an agent (not a workflow) is justified here, and the failure modes you guarded against.
Least-privilege tools, human-in-the-loop for risky actions, sandboxing, spend/iteration caps; explicit prompt-injection defense (untrusted tool/retrieved content).
Retries/fallbacks on tool failure; validated/structured outputs; sane stopping; doesn't loop or blow the budget.
A tool via MCP (or justified); cost/latency control (cheaper sub-models, caching, parallel calls).
An eval set + tracing; a clear argument for why an agent (not a workflow) fits, with failure modes documented.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A production agent: guardrails, MCP & cost control ## Goal Build a production-shaped agent for a real task (a research assistant, a coding helper, a data agent). Deliver: (1) a robust loop with retries/fallbacks for tool failures, validated (schema'd) outputs, and a clear stopping condition; (2) GUARDRAILS — least-privilege tools (allowlist), HUMAN-IN-THE-LOOP approval before any risky/irreversible action, sandboxed execution, and hard SPEND + iteration caps; (3) explicit PROMPT-INJECTION defense — treat all tool/retrieved content as untrusted and constrain capabilities accordingly; (4) at least one tool exposed or consumed via MCP (or a clear justification); (5) COST/LATENCY control (cheaper models for sub-tasks, caching, parallel tool calls); and (6) an EVAL SET + tracing. Document why an agent (not a workflow) is justified here, and the failure modes you guarded against. ## Acceptance criteria - [ ] Guardrails & safety: Least-privilege tools, human-in-the-loop for risky actions, sandboxing, spend/iteration caps; explicit prompt-injection defense (untrusted tool/retrieved content). - [ ] Reliability: Retries/fallbacks on tool failure; validated/structured outputs; sane stopping; doesn't loop or blow the budget. - [ ] MCP & cost: A tool via MCP (or justified); cost/latency control (cheaper sub-models, caching, parallel calls). - [ ] Evals & justification: An eval set + tracing; a clear argument for why an agent (not a workflow) fits, with failure modes documented. ## Verification - [ ] Document installation and run commands. - [ ] Record automated checks and their exact commands. - [ ] Add representative output, screenshots, or a short demo where useful. - [ ] Confirm failure paths and known constraints. ## Decision log ### Decision title - Context: - Choice: - Alternatives considered: - Tradeoffs: ## Evidence - Link each rubric criterion to the file, test, or artifact that demonstrates it. ## Known limitations - List what is intentionally out of scope and what should be improved next.