The capstone produces a tested operating system for one authorized business task. “Post-manual” means routine preparation and safe execution are automated where justified; it does not mean humans disappear from ownership, exceptions, or consequential decisions.
After this lesson, you can assemble requirements, tools, state, evaluation, permissions, operations, and evidence into a go/no-go release.
Choose a Narrow Task
Good candidates include preparing a daily exception report, drafting quotations from approved catalogs, classifying public support requests, or checking documents for missing required fields. Avoid first projects that transfer money, submit legal/tax records, make rights-affecting decisions, or control physical safety.
Define:
business owner and users
observable goal and excluded actions
authoritative inputs and outputs
baseline manual time/error evidence
data classification and retention
success, safety, cost, and reliability targets
Assemble the System Packet
- state machine and checkpoints;
- typed tools with auth, authorization, timeout, and idempotency;
- model policy and version;
- deterministic validators and evaluation set;
- least-privilege identities and exact approvals;
- structured events, alerts, and runbook;
- per-run/tenant budgets and kill switch;
- deployment, schedule/event trigger, concurrency, backup, and rollback;
- privacy notice, access, correction, and deletion process;
- owner sign-off and pilot boundary.
Run Acceptance Tests
Test happy path plus malformed input, prompt injection, unauthorized tool, duplicate event, timeout after effect, provider rate limit, worker crash, concurrent run, changed artifact after approval, budget exhaustion, secret rotation, deletion, backup restore, and rollback.
Save expected result, actual evidence, severity, owner, fix, and retest. A critical defect is NO-GO even if the demo looks polished.
Worked Example
A Faisalabad textile exporter automates preparation of a shipment exception digest. Deterministic code reads authorized shipment events and detects missing documents or overdue milestones. A model summarizes approved fields in English, while a human export officer decides any carrier, customs, or customer action.
The first pilot finds duplicate carrier webhooks create repeated exceptions. Unique event IDs and run keys fix the issue. A prompt-injected document asks the model to email a bank statement; the agent has no email or bank-document tool, so the request is logged as untrusted content. Twenty synthetic runs and five authorized pilot runs meet the declared correctness, latency, cost, and recovery targets. The officer retains a manual report procedure and rollback switch.
Failure Cases to Diagnose
- Baseline never measured: improvement cannot be shown.
- Evaluation uses only ideal examples: add adversarial and operational failures.
- Agent can expand its own scope: enforce tools and identities externally.
- Pilot uses all customers: limit audience, volume, and effects.
- Human checkpoint has no staffing: measure queue capacity and after-hours path.
- Scale claimed from static page traffic: separately load-test accounts, state, tools, and providers.
- No exit path: retain data export, manual procedure, and rollback.
🇵🇰 Pakistan Angle
The business packet should show PKR cost using a dated exchange assumption, PKT support hours, local connectivity failure behavior, and authorized treatment of CNIC, bank, customer, employee, or export documents. Obtain professional review where the task touches law, tax, customs, finance, employment, or regulated services.
To make money ethically, sell a measurable operational outcome: fewer missed cases, faster preparation, better evidence, or lower rework. Do not promise passive income or staff replacement. Price discovery, setup, testing, monitoring, and support explicitly, and use a real client contract and data-processing terms.
Hands-On Exercise
- Complete the task and baseline brief.
- Build all ten packet sections.
- Execute the acceptance matrix and repair defects.
- Run a limited authorized pilot with a rollback drill.
- Produce the evidence report and a truthful service offer.
Done means: an independent operator can run, monitor, stop, recover, audit, and remove the system while the business owner can verify its measured value and remaining risks.
Completion Rubric
- Scope, baseline, owners, and exclusions are explicit.
- Tools, state, permissions, and approvals are enforced.
- Evaluation includes adversarial and recovery tests.
- Budgets, logs, alerts, backup, and rollback operate.
- Pilot evidence supports only measured claims.
- Manual and vendor-exit paths remain viable.
Sources
- NIST — AI Risk Management Framework
- OWASP — Application Security Verification Standard
- Anthropic — Building effective agents
- OpenAI — Agents guide
Key takeaway: a finished agent system is a bounded, tested, reversible business operation with evidence of value—not an unattended demo with broad permissions.