PROMPT → WORKFLOW → AGENT

HOW TO DESIGN AN AI COLLEAGUE THAT CAN ACT

The B.L.U.E.P.R.I.N.T. Intelligent Agent Framework v2.2

Editorial diagram of a governed chain: a sealed mandate linked through authority and operation to assurance.

START HERE

Before an AI can act for you, someone has to decide where it stops.

A prompt gets you an answer. An agent goes and does things in your systems, so you have to decide what it's allowed to touch.

This deck walks through those decisions one letter at a time, using two example agents: one in a bank and one in a clinic.

WHY THIS EXISTS

A newer model won't fix an agent that was never told what it's for.

What people usually assume

If the agent gets things wrong, the fix is a better prompt or a newer model.

↓

What we see in practice

Most problems come from things nobody wrote down: what the agent is for, what it can open, and who checks its work. This deck helps you write that down. Your tech team builds the prompt, the access and the tests from it.

DO YOU NEED AN AGENT?

1 · Could one well-written request, checked by you each time, do the job?

If yes, a good prompt is enough.

Use PINPOINT to write that request well.

2 · Does it need to use your systems, such as looking things up, updating records or sending messages?

If it only needs to answer, set up an assistant with one clear job. A person still acts on what it says.

Use BLUE: the first four letters.

3 · Does it have to work out its own steps, because every case is different?

If the steps are always the same, write them down and use ordinary software or a workflow. AI can still do one step inside it.

Three yeses means you're building an agent, and BLUEPRINT is how you describe it. Stop at the first no and use what it points to.

Anthropic, Building Effective Agents (19 December 2024): find the simplest solution possible and only increase complexity when needed, which may mean not building an agentic system at all.

A workflow is a job where you already know the steps. An agent is a job where something has to work out the steps each time. Most work that looks like it needs an agent is a workflow with one or two decisions inside it.

Wherever you stop, write down why in one sentence. It's the first question a reviewer will ask.

OUR TWO EXAMPLES

Two agents we'll build together.

In a bank: Priya's meeting-briefing agent

Priya is a relationship manager. Before each client meeting she pulls notes together from several systems.

Her agent will do that for her: read what's relevant and hand her a one-page brief the evening before.

In a clinic: Dana's front-desk agent

Dana runs the front desk at a busy family clinic. Every morning she checks who's booked in, which forms are missing and who hasn't confirmed.

Her agent will prepare that list and draft reminder texts for her to check.

Each letter adds one decision to both agents. By the end you'll have a full description of each, and a template for your own.

FROM AN IDEA TO A DESCRIPTION · PRIYA

Where most ideas start, and where they need to get to.

HOW THE IDEA USUALLY ARRIVES

“An assistant that helps relationship managers prepare for meetings. It should look up whatever is relevant for each client, in a professional tone. Don't give investment advice.”

This covers tone and one thing to avoid. It says nothing about what a finished brief looks like, what the agent can open, or who answers for it.

→

THE JOB

A one-page brief for Priya, ready the evening before each client meeting. Priya's team lead signs off on what a good brief contains.

WHAT IT DOES ALONE, AND WHAT IT ASKS ABOUT

It reads meeting notes and client records by itself. It asks before suggesting any follow-up. It gives no investment advice.

WHAT IT CAN OPEN

Only what Priya can open, through its own login. It can read, but it can't change or send anything.

FROM AN IDEA TO A DESCRIPTION · DANA

The same step for Dana at the front desk.

HOW THE IDEA USUALLY ARRIVES

“Something to help the front desk get through the morning. It should check the bookings, chase patients who haven't filled in their forms, and sound friendly. Don't give medical advice.”

Friendly tone and one thing to avoid again. It doesn't say when the list is due, who may send a text to a patient, or what it can see in the booking system.

→

THE JOB

Tomorrow's patient list for Dana by 8am, with missing forms flagged and reminder texts drafted. The practice manager signs off on what a good list contains.

WHAT IT DOES ALONE, AND WHAT IT ASKS ABOUT

It checks bookings and forms by itself. Every reminder text waits for Dana to approve it. It never answers questions about symptoms or treatment.

WHAT IT CAN OPEN

Only this clinic's bookings, through its own login. It can draft texts, but it can't send them, change a booking or open medical notes.

WHAT AN AGENT IS

An agent is AI with a goal and permission to act. It picks a step, does it, checks what happened, and keeps going until the job is done or it has to stop.

Decide→Act→Check→Decide again↺done, or stopped ↗

It still uses prompts. The difference is that it keeps going by itself.

Anthropic, Building Effective Agents (19 December 2024): workflows are systems where language models and tools are orchestrated through predefined code paths; agents are systems where the models dynamically direct their own processes and tool usage, keeping control over how they accomplish tasks.

Simon Willison, 18 September 2025: “An LLM agent runs tools in a loop to achieve a goal.”

PROMPT OR AGENT?

With a prompt, you decide each step. With an agent, it decides.

A promptAn agent

Who decides the next stepYouThe agent

How often it asks the AIUsually onceMany times, in a loop

What you get backTextText, plus things it has done

What it carries between stepsWhatever you paste inIts own notes on what it has done so far

When it goes wrongYou get a bad answerSomething gets done that shouldn't have

That last row is why an agent needs its job and its limits written down.

WHERE BLUEPRINT SITS

LevelWho decides the next stepFramework

PromptYou, each timePIN / PINPOINT

WorkflowA path written down in advancePINPOINT for each step

AgentThe AI, within limits you setBLUEPRINT

Several agentsEach agent, within its own limitsOne BLUEPRINT per agent

Most real systems are a mix. If only one step needs the AI to decide, describe it as a workflow with one smart step.

THE FIRST FOUR LETTERS

BLUE

Start with the least structure that works.

B

Behaviour & Values

What should it put first, and what does it do when unsure?

L

Limits

What can it do alone, what must it ask about, and what is off-limits?

U

Use Case & Outcome

What is the one job, who is it for, and what does finished look like?

E

Examples

What does a good result look like, and have you tried the awkward cases?

BLUE is enough for an assistant that only answers questions. Once it can open systems or do things, add PRINT.

BLUE · B

B Behaviour & Values

Give it a ranked list of what matters.

Why it mattersRules cover the cases you thought of. Something will come up that you didn't, and the agent needs to know what matters most when it does.

Priya's briefing agent (bank)

Accuracy comes before speed. If two records disagree, it says so. If it isn't sure, it does less and tells Priya why.

Dana's front-desk agent (clinic)

Patient privacy comes first, then accuracy, then getting the list out on time. If a booking looks odd, it flags it for Dana.

Write downYour agent's top three priorities, in order. When two clash, which one wins?

BLUE · L

L Limits & Autonomy

Sort everything it might do into three lists.

Why it mattersAn agent will try whatever seems helpful. Without clear lists, it has to guess where your line is. Reading counts too: opening a file is an action.

Priya's briefing agent (bank)

Just do it: read meeting notes. Ask first: suggest a follow-up. Off-limits: recommend investments.

Dana's front-desk agent (clinic)

Just do it: check the day's bookings. Ask first: send a reminder text. Off-limits: give medical advice or move an appointment.

Write downThree lists: just do it, ask first, off-limits. If something isn't on any list, it stops and asks.

BLUE · U

U Use Case & Outcome

One job, one person who answers for it, and a clear picture of finished.

Why it mattersAn agent with a vague job drifts into other work. When something goes wrong, nobody is sure whose call it was.

Priya's briefing agent (bank)

A one-page brief for each client meeting, ready the evening before. Priya's team lead answers for it.

Dana's front-desk agent (clinic)

Tomorrow's patient list, with missing forms flagged and reminder drafts ready by 8am. The practice manager answers for it.

Write downThe job in one sentence, the named person who answers for it (a person, so no team names), and what finished looks like.

BLUE · E

E Examples & Evaluation

Collect examples of good and bad, then test it on the awkward ones.

Why it mattersAn agent can reach a good answer the wrong way, for example by opening something it shouldn't. It can also answer the same question differently on different days.

Priya's briefing agent (bank)

Test a normal meeting, a client with out-of-date records, two systems that disagree, a record Priya can't open, and a request it must refuse.

Dana's front-desk agent (clinic)

Test a normal morning, a double booking, a patient with no phone number, a record from another clinic, and someone asking it for a diagnosis.

Write downFive test cases, including one it should refuse. Agree the pass mark before you run them, and run each one more than once.

THE NEXT FIVE LETTERS

PRINT

Add these once the agent can open systems and do things.

P

Permissions & Identity

What can it open?

R

Reliability & Recovery

What if something breaks?

I

Interfaces & Handoffs

Which tools does it use?

N

Navigation & Orchestration

How does the work flow?

T

Trusted Context & Memory

What does it read and keep?

BLUE describes the job. PRINT describes how it gets done safely inside your systems.

PRINT · P

P Permissions & Identity

Telling it isn't the same as stopping it.

Why it mattersIf we only tell the agent “don't look at other advisers' clients”, it can still try. A block in the system makes it impossible.

Priya's briefing agent (bank)

Set it up like a new joiner's login. It has its own login, so we can see what it did. It can only open what Priya can open. For now it can read, but it can't change or send anything.

Dana's front-desk agent (clinic)

It signs in as itself and sees only this clinic's bookings. It can draft reminder texts. They go out only after Dana approves them.

Write downWhose access does it borrow, and what is it blocked from?

PRINT · R

R Reliability & Recovery

Decide what happens when something breaks.

Why it mattersSystems go down, data goes out of date and AI models get updated. An agent that quietly guesses its way past a problem does more harm than one that stops.

Priya's briefing agent (bank)

If the client records system is down, Priya still gets a brief, marked incomplete, saying which part is missing.

Dana's front-desk agent (clinic)

If the booking system times out, it stops, tells Dana which patients it hasn't checked, and sends nothing.

Write downWhen it gets stuck: what it does, who hears about it, and how you undo anything it already did. Keep a full record of every run, like a flight recorder.

PRINT · I

I Interfaces & Handoffs

Before it uses a tool, write down what the tool does and what it can break.

Why it mattersThe agent only knows a tool by its description. If “no record found” and “access blocked” look the same, it may tell Priya a client has no history when it was locked out.

Priya's briefing agent (bank)

The calendar tool reads meetings. The client records tool reads notes and can't change them. Each one says clearly when it's empty, broken or blocked.

Dana's front-desk agent (clinic)

The booking tool reads appointments. The text tool can send only drafts Dana has approved. If it fails, it says so.

Write downFor each tool: what it's for, what it changes, and what it says when it fails.

PRINT · N

N Navigation & Orchestration

Fix the steps you already know. Let the agent decide only where it has to.

Why it mattersThe more steps the agent chooses, the harder it is to predict. Most jobs are a fixed path with one or two judgement calls inside.

Priya's briefing agent (bank)

Find tomorrow's meetings, pull the records, write the brief. The agent decides only what's relevant for each client. If sources disagree, it stops and asks Priya.

Dana's front-desk agent (clinic)

List the bookings, check the forms, draft reminders. The agent decides only how to word each reminder. It stops when the list is done or it hits something it can't handle.

Write downThe steps that are always the same, the one or two it decides, and when it should stop.

PRINT · T

T Trusted Context & Memory

Decide what it reads, what it trusts most and what it keeps.

Why it mattersAgents read a lot. Some of it is out of date, some of it contradicts itself, and some of it might be an email saying “ignore your rules”.

Priya's briefing agent (bank)

The client records system outranks old emails. Every fact shows its date. If an email tells it to ignore its rules, it flags the email to Priya. It keeps nothing once the meeting is over.

Dana's front-desk agent (clinic)

The booking system outranks old phone notes. If two records clash, Dana sees both. It keeps no patient details after the day's list is done.

Write downIts sources in order of trust, how old is too old, and what it may remember.

MY VIEW ON "HUMAN IN THE LOOP"

A person in the loop only helps if they can say no.

1983: he broke the loop

Stanislav Petrov's early warning system reported incoming US missiles. Protocol said escalate. He questioned it instead, and it was a false alarm caused by reflected sunlight. He didn't save the world by being in the loop. He saved it by being willing to break it.

A rubber stamp isn't a safeguard

Too often the person is the last signature on a recommendation made somewhere else, in a hurry, with little context and pressure to approve. The real danger is people who stop thinking because the machine sounds confident.

People get tired

We make worse calls when we're tired, rushed, in a bad mood, or late in the day after a long run of decisions. Adding one more approval step doesn't fix that.

What works better

The agent keeps learning each person's preferences and sticks strictly to the limits you set earlier: what it does alone, what it asks about, and what it can open. People are asked only where their judgement changes the outcome, with the time and context to say no. Priya gets one flagged follow-up to decide, not forty approvals. Dana approves the reminder texts, not every booking check.

Better questions to ask: Where does a person's judgement change the outcome? What happens when they say no? Do they have the time and context to challenge it? Who answers for it when it's wrong? Can you switch it off?

WHY "ASK FIRST" NEEDS CARE

People stop reading approval requests.

3%of one-at-a-time “can I do this?” requests were turned down.

39%of whole plans were turned down when people saw all the steps together.

13.6%of planted dangerous commands were caught by the people approving.

89%of the same commands were caught by an automated check.

People also got worse with practice. After about 50 requests, they caught around 5% of the dangerous ones, down from about 17%.

What this means for your agent: ask people to approve the whole plan, and let the system block anything that should be impossible. These numbers come from AI coding sessions, and we're assuming they carry over to other kinds of approval. Source: claude.com/blog/auto-mode-default-in-claude-code · 7 August 2026 · 1,053 testers.

CHECK YOUR DESCRIPTION

Three questions before you hand it over.

01For everything on your “off-limits” list, is there a system block and a test that proves it holds?

02For everything on your “ask first” list, do you know who gets asked and how?

03Is anything you can't undo sitting on the “just do it” list? Move it.

The agent doesn't mark its own homework. A person or a fixed rule does.

The full nine-letter check is in the “For your tech team” section at the back.

KEEPING IT UP TO DATE

When anything changes, test it again.

Writedescribe the agent using the nine letters.

Testrun your test cases against the pass marks you agreed.

Launchswitch on the approved version.

Watchnote failures, hand-offs and what people corrected.

Reviewa person decides whether the description needs to change.

Updatesave the new description, access, tools and tests together as a new version.

When the instructions, the tools or the AI model change, treat it as a new version and test it again before it goes live. Corrections from people are evidence for the next review. The agent doesn't rewrite its own rules.

IS IT CLEAR ENOUGH?

Could someone from risk or audit read it and understand:

1what the agent is supposed to do

2what it is allowed to do

3how it is tested

4who answers for it

5and how it can fail

Then try one real run. Pick a single piece of work the agent did. Can you show what it looked at, what it was allowed to do, which checks ran, what the person saw and changed, who decided, and what went out?

THE FULL JOURNEY

01PIN

Define the task

02PINPOINT

Write the request and check the result

03BLUEPRINT

Describe the AI colleague

BLUEPRINT is the job description.

Your systems make sure it's followed.

EVOLVE

tells you how much to trust it as you grow.

TAKEAWAY

Every agent that works well had someone decide its limits first.

Start with BLUE. Add the PRINT letters once it can open systems and do things. The template is at the back.

FOR YOUR TECH TEAM · GLOSSARY

The words you'll hear, in plain English.

TermWhat it meansThink of it as

Agent / agenticAI that does several steps by itself, using your systemsA new hire who can log in

Delegated authorityWhat it's allowed to do without askingA spending limit on a company card

Specification (spec)The written job description and rulesJob description plus policy manual

Deterministic checkA fixed rule in the system, with no AI opinion involvedThe card machine declining the payment

Effective permissionIt can see no more than the person it works forAn assistant using their boss's access

Authorise before retrievalCheck access before it reads anything. Once read, it can't be unreadYou can't un-tell a secret

Fail closedIf unsure, do nothing and askA door that locks when the power goes

Non-deterministicIt can give different answers to the same questionTwo colleagues, two drafts

FOR YOUR TECH TEAM · GLOSSARY

More terms.

TermWhat it meansThink of it as

Evals, pass bars, adversarial casesTests, agreed pass marks, and tests where someone tries to trick itA driving test with a set score

Replayable recordA full log, so you can show exactly what happened laterA flight recorder

Pinned modelThe AI version is locked. Changing it means testing againNo engine swap without a new MOT

DriftIt slowly gets worse as things around it changeA sat nav with old maps

Side effect, retry safetyWhat a tool changes, and whether it's safe to try twicePressing “pay” twice

OrchestrationHow the steps are arranged and who picks the next oneA recipe, or a chef improvising

Context, state, memoryWhat it's looking at now, where it is in the job, what it keepsToday's notes and the client file

MCP, APIsWays of connecting the agent to tools. BLUEPRINT works with any of themThe plug, whatever the socket

CRM, RMClient records system; relationship manager

FOR YOUR TECH TEAM · TEMPLATE

Fill in the BLUEPRINT.

BBehaviour & Values

LLimits & Autonomy

UUse Case & Outcome

EExamples & Evaluation

PPermissions & Identity

RReliability & Recovery

IInterfaces & Handoffs

NNavigation & Orchestration

TTrusted Context & Memory

FOR YOUR TECH TEAM · THE NINE LETTERS IN DETAIL

B

Behaviour & Values

Ranked principles, written as “when X, do Y over Z”. Standard one for any agent that acts: report an action as done only when the tool confirmed it.

L

Limits & Autonomy

Always, ask first, never. Anything unlisted stops and escalates (fail closed). Reading is classified too.

U

Use Case & Outcome

One verb, one object, one beneficiary. The trigger, who it acts for, one named owner, who is affected, today's baseline.

E

Examples & Evaluation

Check outcome, path and controls. Normal, edge, adversarial, failure and refusal cases. Pass bars set in advance; control tests need 100%.

P

Permissions & Identity

Three identities (agent, person it acts for, owner), no shared accounts. Effective permission is the overlap. Authorise before retrieval.

R

Reliability & Recovery

Fail to a safe state. Every write has an undo. Pinned models. A replayable record of inputs, versions, controls, human edits and outputs.

I

Interfaces & Handoffs

Each tool states purpose, input, output, side effect, retry safety and failure shape. Empty, failed and denied look different.

N

Navigation & Orchestration

Fixed steps where known. Five stop conditions: done, budget used up, no progress, blocked, out of bounds. It reports its state when it stops.

T

Trusted Context & Memory

Ranked sources, as-of dates, no persistent memory by default. Memory inherits its source's permissions. Retrieved content is treated as data.

FOR YOUR TECH TEAM · CROSS-LETTER CHECKS

The full consistency check.

01Every “never” item has a denial in P and a test in E.

02Every “ask first” item has a handoff in I and a test in E.

03No irreversible action sits under “always”.

04Done is defined in U, stop conditions in N, failure handling in R.

05Every memory write is classified in L.

The agent doesn't grade its own permissions, judge its own work, or decide whether its own controls run.

FOR YOUR TECH TEAM · TOOLS AND FLOW

Tool contracts and how the work moves.

purposeinputoutputside effect: read / write / actretry safetyfailure shape

single call→fixed sequence→router→parallel workers→orchestrator + workers→evaluator loop→autonomous loop

Tool names and descriptions work like prompts. Write them like a brief for a new hire.
A handoff between agents or people is a PINPOINT brief: purpose, context with evidence, a narrow ask.
BLUEPRINT doesn't depend on a protocol. MCP and APIs are implementation choices.
Move right along the path only when the job needs it.

FOR YOUR TECH TEAM · SEVERAL AGENTS

Adding agents adds no authority.

One BLUEPRINT per agent, and one agreed contract for each handoff.

MAKER

Produces the proposed result inside its own job, access and stop conditions.

→

CHECKER

Checks the evidence, the controls and the acceptance criteria on its own. It doesn't inherit the maker's access.

An agent receiving work gets only the permissions granted to its own role.
The strongest reason for a second agent in banking is maker-checker: one prepares, a separate one verifies.

FOR YOUR TECH TEAM · REPLAY ONE RUN

Can you replay one run?

A supervisor picks one AI-assisted client interaction. Every answer should already be in the record, and each traces to a letter. European regulators will look closely at AI in investor-facing work from 2027 (ESMA has made it a Union Strategic Supervisory Priority).

The questionWhere it livesEvidence kept

Why this client, and why this insight?U · Ttrigger, context used, as-of dates

What did it use, and which model and version produced it?T · Rsources as of that moment, pinned model, spec version

What was it allowed to do, and which controls ran?L · P · Eeffective permissions, each control and its result

What did the person see and change, and who decided?L · U · Rproposed versus approved, why, named approver

What went out to the client?I · Rthe exact message sent

Can the bank reproduce it later?R · Versionkept record, retrievable version

FOR YOUR TECH TEAM · SHARED WITH PINPOINT

Evidence labels

[Verified Source]

[Inference]

[Assumption]

[Unverified]

Labels for “I checked this” and “I'm guessing”. In PINPOINT you ask for them in a single request. In BLUEPRINT the agent uses them all the time: B says so, and T enforces it.

FOR YOUR TECH TEAM · READ

Daily meeting-briefing agent

Read→Propose→Act

Low autonomy · read-only · relationship-led financial services

Job

Before a scheduled client meeting, put together a one-page brief from authorised records for the assigned relationship manager.

Trigger

A client meeting is in the calendar for the next working day.

Flow

find relevant records → spot recent changes → write the brief → flag gaps → finish.

Always do

Read authorised information; summarise recent changes; separate fact from inference; flag stale or conflicting information.

Ask first

Nothing in normal running.

Off-limits

Changing source records; sending messages; recommending anything outside its job.

When it fails

If a source is down or an access check fails, it produces an incomplete brief that names the missing source. It doesn't guess to fill the gap.

Why it matters

The agent chooses what to read and how to put it together. Its authority to act on the client relationship stays close to zero.

FOR YOUR TECH TEAM · PROPOSE

Client follow-up agent

Read→Propose→Act

Approval before action · relationship-led financial services

Job

After a client meeting, prepare the follow-up message, the proposed actions and the record updates for the relationship manager to approve.

Trigger

The client meeting is marked complete.

Flow

meeting notes → pull out commitments → check supporting context → draft follow-up → propose CRM and task updates → ASK FIRST → carry out only approved actions → confirm.

Always do

Draft the message; list agreed actions and owners; prepare proposed system updates; flag unsupported statements.

Ask first

Sending the message to the client; writing or updating CRM records; creating follow-up actions that matter.

Off-limits

Changing wording after approval; inventing commitments; sending when required evidence is missing; treating silence as approval.

When it fails

If approval expires, the content changes after approval, or the send or update fails, it stops and reports exactly where things stand. It doesn't retry blindly.

Why it matters

The agent prepares everything. A person approves before anything goes out, and the description has to cover both.

FOR YOUR TECH TEAM · ACT

Operations exception agent

Read→Propose→Act

Bounded autonomy · relationship-led financial services

Job

Watch for service exceptions in client operations and fix standard, reversible cases within a written remit.

Trigger

A new exception arrives in the queue.

Flow

classify → gather evidence → pick an allowed fix → act → check the result → close or escalate.

Always do

Fix approved low-risk categories; gather the evidence needed; make reversible updates; record sources and actions; check the result afterwards.

Ask first

Anything outside set thresholds; changes the client will see; cases where policies conflict; anything above financial or reputational limits.

Off-limits

Getting round access controls; inventing a fix category; anything irreversible; carrying on after repeated failure.

Stopping safely

It stops when done, blocked, outside its remit, making no progress, or at a limit. It keeps its work, explains what it finished, names the blocked step and hands over to the named owner.

Why it matters

The agent chooses and acts, inside limits set before it runs. A named owner still gets anything it shouldn't finish.