Define when the agent should escalate
Start with requests that need an account change, a person’s judgment or information outside approved knowledge. Make the permitted actions and escalation rules explicit. The agent should not claim it has performed an action that its tools cannot confirm.