Domain Playbooks

Customer-Support Agents

Optimize deflection subject to a near-zero confident-wrong-answer rate: grounded answers autonomous, transactions gated, tone graded in the eval, clean handoff over a confident guess.

Data & Analytics Agents

The failure mode is a confidently wrong number: schema/semantic-layer grounding, read-only execution, verification as a separate stage, and abstention scored above confident error.

DevOps & SRE Agents

Read-only first because the blast radius is production: diagnosis before remediation, runbooks as tested tools, limits in the tool signature, change control unchanged by the operator being a model.

Research & Synthesis Agents

A fabricated source voids the whole deliverable: retrieve-then-write-then-verify, citation faithfulness as a hard constraint, disagreement preserved not averaged, depth vs breadth as a bounded budget.

Sales & GTM Agents

The failure mode is automated spam at scale: value in research/personalization not volume, consent as an upstream fail-closed gate, human sign-off scaling with reach, spam-risk weighted heavily in the eval.

Finance agents

Where agents earn their keep in finance — reconciliation, research synthesis, KYC review — and the hard rails (audit, determinism, regulator-readable trails) they must carry.

Healthcare agents

Charting, prior auth, intake triage — the few healthcare jobs where agents shave real labor, and the privacy + clinical-safety guardrails you cannot ship without.

Legal agents

Discovery, contract review, citation checking — where legal agents already work, where they hallucinate, and what supervision they need by jurisdiction.

Adapting a Playbook to Your Domain

The meta-method behind every playbook: derive a new vertical by answering five questions in order — job, autonomy by reversibility, tools as grounding-and-limit, eval mirroring the cost asymmetry, structural guardrails.

Hiring & Recruiting Agents

The one domain where regulators specified the architecture first: NYC Local Law 144 and EU AI Act Annex III demand a countable, attributable per-candidate decision — which is why the free-text "strong fit, 8/10" design fails an audit, and why the model belongs on the widening side of the funnel.

Email & Calendar Agents

The only system of record an unauthenticated stranger can write to: provenance tiers that survive a forward, a reader/actor split with a typed interface so message content can never reach the send path, calendar as the zero-click vector nobody hardens, and confirmations that ask only when something is unusual.

Tutoring & Learning Agents

The only domain where doing the task well is the failure: measure unaided post-test rather than session satisfaction, enforce the hint ladder in code, diagnose the misconception instead of explaining the topic, and accept that any agent able to do the homework has already broken homework as assessment.

Security-Operations Agents

The only agent whose input is authored by an adversary who knows a model reads it: deterministic enrichment with the verdict kept out of the model, autonomy by reversibility with containment gated, and a golden set built from the closures you were never told were wrong.

Translation & Localization Agents

Fluency stopped predicting fidelity, so reading the target text catches nothing: review the source-target pair in a diff, gate on machine-checkable invariants — placeholder parity, termbase, structure — and treat terminology as retrieval rather than a glossary in the prompt.

Shopping & Checkout Agents

Instant Checkout was pulled back with fewer than fifteen merchants live because product data, not payments, was the hard part — so ground the item, re-verify at purchase time, and gate the one irreversible step outside the model.

Content Moderation Agents

The published guidelines are a summary of a decade of unwritten precedent, so build moderation as retrieval over decided cases — and let the base rate, not the accuracy score, tell you how many reviewers you still need.

Insurance Claims Agents

Cycle time is spent waiting for a missing document, not deciding — so build the completeness engine, stop at the coverage determination, and decline fraud scoring deliberately: it is the use case with the worst risk-adjusted return in the domain.

IT Helpdesk Agents

The tickets that cost you all end in a mutation of an identity system, so the product is the authorisation layer: proof identity out of band on a possession factor, derive the action set from entitlements rather than the request, and ship password and MFA recovery last — or never.

KYC & AML Onboarding Agents

With 90–95% of screening alerts false positive, the constraint was never detection but the backlog of alerts nobody can write up defensibly — so the agent assembles evidence and drafts the rationale, a named human disposes, and the sanctions matcher stays deterministic and versioned.

Procurement & Sourcing Agents

A losing bidder is entitled to the reasons for the award, so the one thing to automate is not the score: build the requirement-coverage matrix with page-level locators, isolate each bid in its own index, and keep ranking with a named human who can defend it.

Public-Benefits Casework Agents

MiDAS auto-adjudicated fraud for 34,000 people at a roughly 93% error rate and the Dutch benefits scandal took down a cabinet — so the agent assembles the packet and a named human determines, retrieval is pinned to the rules in force on the claim date, and the error you must measure is the denial nobody appealed.

Travel & Booking Agents

Search is free and repeatable; the booking is a payment, a contract and a seat someone else loses — so build them as two systems, and make the committed path accept a quote ID rather than parameters, re-price at commit, carry an idempotency key and reconcile instead of retrying.

Supply-Chain & Logistics Agents

The failure mode is not hallucination, it is acting confidently on a fact that was true four hours ago — so put a mandatory as_of on every tool response with a code-enforced maximum age, leave routing to the solver and scope the agent to a closed exception taxonomy, and measure the exception it never raised rather than the precision of the ones it did.

Field Service & Dispatch Agents

Scheduling is the one part already solved — a constraint solver beats a model at assignment, so the agent belongs at the two edges it cannot read: intake that decides which parts go on the truck, and the reschedule call when the day breaks. Every board write is a promise, so reserve-then-confirm it, assume human dispatchers are writing too, and measure first-time-fix rather than automation rate.

Accounts Payable & Invoice Agents

Best-in-class touchless has hovered near 49% for years and the failing half is not failing on reading the document — it fails because there is no PO, no receipt, or nobody ordered it, so build for the exception queue rather than the clean lane. Gate on irreversibility instead of amount: a bank-detail change is the loss you never claw back.

Collections & Dunning Agents

Regulation F allows seven calls per debt per seven days; New York City's SHIELD rule allows three communications of any kind per account — so the contact governor, not the model, is the product, and every channel must decrement one authoritative counter before it composes a word. Right-party contact comes before content, and disclosures, balances and offer ladders belong to code.