Write the proposed trigger, required context, allowed actions, prohibited actions, approval thresholds, cost or usage limit, expected output, evidence to retain, and recovery owner. Specify which system remains authoritative for customer, financial, identity, document, or product state. The contract should be understandable to the function owner, technical team, and reviewer without depending on hidden prompt knowledge.
Separate preparation from execution. The system may retrieve approved sources, classify a request, assemble a brief, or propose an update while a person retains authority to communicate, commit, change access, spend, or release. If bounded execution is included, bind it to resource, destination, amount, frequency, environment, and time as appropriate. Permission for one loop should not become general permission elsewhere.
Document edge cases before implementation. What happens when a source is stale, two records conflict, the requester is unauthorized, the expected reviewer is unavailable, a tool fails after a partial action, or a budget is exhausted? A safe pause and a clear escalation are successful outcomes. Requiring completion in every case encourages the system to conceal uncertainty and exceed the intended scope.