You have the parts: a bounded goal, a small tool set, a state record, an owner. Now you assemble them into something that runs — the smallest loop that does one useful job and stops.

The bounding decision

Every first agent is five choices on one line:

one goal + one source set + one safe tool + one output + one stop condition

Fill in that line before you touch any code. Examples that pass:

• Daily source watcher. Goal: flag new items. Sources: five approved feeds. Tool: page fetch. Output: one daily Markdown packet. Stop: all five checked or ten minutes elapsed.
• Support-ticket classifier. Goal: label new tickets. Sources: today's unclassified tickets. Tool: read ticket plus write label to state. Output: labeled queue plus an exceptions list. Stop: queue empty or fifty tickets.
• Knowledge-base freshness checker. Goal: find stale pages. Sources: twenty help articles. Tool: fetch page plus compare timestamp. Output: stale-page list with last-verified dates. Stop: all twenty checked.
• Report-draft assistant. Goal: draft from approved inputs. Sources: three named filings. Tool: retrieve filing plus save draft. Output: one draft with citations. Stop: draft saved or one retry on a failed fetch.

And the specification that fails: "make an agent that runs my business." That sentence has no source list, no output file, no stop condition, and no owner. It cannot be tested, bounded, or debugged. Every ambitious idea must be cut down to the five-choice line before it earns tools or autonomy — your exercise does exactly that cut.

Demystifying the implementation

Here is the reassuring secret: many custom agents are ordinary Python programs.

Python code can call a model API, call an approved tool or API, store a JSON or database record, and run again later from a cron schedule, a queue worker, a Docker container, a Mac mini, or a VPS — every runtime you met in Part VII. There is no mysterious new programming language to learn. The "agent" is the system design around that code: the goal, the tools, the state, the loop, the stop rule.

The modern workflow makes this more approachable, not more mysterious. A coding LLM can draft the Python, explain each function in plain language, write tests, and help debug failures. You do not need to memorize all of Python before starting. You do need four human abilities no model supplies for you:

1. State what the code is allowed to do (the tool inventory from Lesson 28.2). 2. Inspect the plan before it runs — which tools, which sources, which outputs. 3. Run tests with safe data and read the results. 4. Verify the actual output before granting more permissions.

Generated code is still production code. The owner tests it, reads its permissions, keeps secrets out of source files, and reviews anything that can publish, spend, delete, or change production systems. The deeper code-and-project discipline arrives in the AI Development Methods and Build Software parts; this lesson only needs the shape.

The conceptual shape

Memorize this loop. It is the skeleton of nearly every small agent:

receive job → load approved state → call tool and/or model
  → validate the result → save result + update state
  → stop, or request review

Walk it with the daily watcher. Cron fires at 7 a.m. The program receives the job (check five feeds), loads last night's state (what was already saved), calls the fetch tool for each unchecked source, asks the model to judge which findings are new and worth flagging, validates that every flagged item has a link and timestamp, saves the packet and updates the state record, then stops. If a fetch fails, the error goes into state and the loop continues with the next source — or stops with a missing-evidence note if too much is missing.

Validation deserves emphasis. The program checks the result before saving it: required fields present, links resolve to approved sources, numbers carry units, confidence is stated. A fluent draft that fails validation is not saved as success — it is saved as pending review with the failure noted. Lesson 30.4 turns this into a scorecard; build the habit now.

Check your understanding

1. Recite the five-choice bounding line for your own agent idea. 2. Where does the agent run — cron, queue worker, container, mini, VPS — and why did you pick that runtime? 3. What does the validation step check before a result is saved? 4. Why is "runs my business" not a useful first specification?

Exercise: bound your v1 and define its finish line

Take your most ambitious agent idea and cut it to a v1 that fits the five-choice line. Write it down:

## Ambitious idea
<e.g. "An agent that runs my customer research.">

## Bounded v1
- Goal: <one sentence>
- Sources: <named, numbered>
- Tool: <one safe tool>
- Output: <one named artifact + location>
- Stop: <count or time budget>
- Runtime: <cron / queue / container / mini / VPS — one choice + why>

## Finish line
<observable proof: e.g. "One packet at review/2026-09-12.md with
3+ linked findings, state record updated, run stopped under 10 min.">

Worked example:

## Ambitious idea
"An agent that handles all competitor intelligence."

## Bounded v1
- Goal: Flag new citable facts about 2 named competitors each morning.
- Sources: 5 approved feeds (listed in state).
- Tool: fetch_page (read-only) + write_review_packet to review/.
- Output: review/YYYY-MM-DD-packet.md with findings, links, confidence.
- Stop: 5 sources or 10 minutes, whichever comes first.
- Runtime: cron on my Mac mini — daily, visible logs, no server to operate yet.

## Finish line
One packet with at least one linked finding (or an explicit
"nothing new" note), a matching JSON state record, and a log showing
the run stopped on time.

Finish line: the written v1 above — five choices, one runtime, one measurable proof of done.

Verify: run the checklist: can a stranger tell what sources it reads, what file it writes, and when it must stop? Can you test it with safe data this week?

Common failure: smuggling the ambition back in ("v1 also sends the packet to the team and posts highlights"). Sending and publishing are separate grants with separate approvals. V1 stops at the draft.

Next, you zoom out: if agents can carry real jobs, what does it mean to treat one like an employee?