3 risks to put in the spec
- Rogue actions: wrong tool calls, wrong writes, wrong sends. Mitigate with least privilege, sandboxing, approvals, rollback.
- Low observability: you can’t reconstruct what happened. Mitigate with end‑to‑end traces/logs, versioning, rationale capture.
- Bad memory: unverified info becomes “long‑term truth.” Mitigate with memory tiers, reviewability, deletion, and strict gating.
One‑sentence summary: Agentic AI is “AI that can act”—and action must be controllable, traceable, and reversible.