Stop tuning the prompt. Your AI agent needs a contract.

TL;DR I built an AI agent to draft my weekly blog and newsletter. The prompt took an afternoon. What made it safe to hand off real work was a contract: one place to read and write, rules it cannot argue its way out of, and a hard stop before anything goes public. If you are a non-technical PM trying to delegate to an agent, write the contract before you touch the prompt.

Friday morning. I am making coffee. On the other screen, an agent I set up two weeks ago is drafting my newsletter. It reads my week from a running log, picks the sharpest idea, and writes a draft that sounds like me.

And my first instinct is to go fix the prompt.

One line reads slightly off. So I open the system prompt and start typing instructions. Be more direct here. Hedge less there. It is the thing every non-technical person does the second an AI is almost right. We treat the prompt like a volume knob and keep turning it.

Then I stopped. Because the offline was not a prompt problem. The agent had pulled a stale note from the wrong folder. No wording change fixes that. This is the same lesson I keep relearning the slow way, the one behind build to learn, build to earn: you learn what is actually needed by building it and watching it break.

Here is what running my own agent taught me. The prompt is the easy part. The part that decides whether you can trust an agent with anything that matters is the contract you write around it.

I call it the Agent Contract. Three clauses. Skip any one of them, and you do not have an agent; you have a confident intern with no supervision and root access.

Clause 1: One source of truth

Before I changed a single word of the prompt, I moved everything the agent reads into one folder.

My context used to live in three apps. Notes in one. The voice rules in a doc somewhere. The week’s progress in my head and a few half-finished lists. When I first wired up the agent, it wrote fine sentences built on the wrong facts, because it was reading whatever scrap it found first.

So I made a rule. One folder is the source of truth. The agent reads from it and writes back to it. Nothing important lives anywhere else. When a fact changes, it changes in one place, and the next draft is correct without me touching the prompt.

This is not an AI insight. It is the oldest product lesson there is. A backlog spread across five tools is not a backlog. A roadmap that lives in three decks is not a roadmap. The agent just made the cost of scattered context obvious and immediate, because it acts on whatever it reads today, without asking.

If you want to test your own setup, ask one question. If your agent is wrong, do you know exactly which file to fix? If the answer is “somewhere in a few places,” that is your real bug. Not the prompt.

Clause 2: Constraints in writing

The second clause is a written set of rules the agent cannot talk its way out of.

For me, that is a voice file. It lists the words I never use. It bans the patterns that make writing sound like a press release. It says, in plain terms, never invent a number, a name, or a source. If a figure is missing, leave a flag for me instead of guessing.

Here is why writing it down beats reminding the agent in chat. A reminder is a suggestion that the model weighs against everything else you said. A written constraint that the agent reads on every run is a wall. The difference shows up the moment you are not watching. And the whole point of an agent is that you are not watching.

I learned this writing PRDs for agents, which I wrote about in I rewrote my PRD template for agents. The instructions that held up were never the clever ones. They were the boring, specific constraints. What it must never do. What counts as done? The same logic runs through the three PRD lines I use for agentic commerce. You are not describing a feature. You are setting edges.

There is a line I keep on my desk for this. Context beats prompts. Examples beat prescriptions. Constraints beat rules. An agent with a clear wall and three real examples will outwork an agent with a paragraph of polite guidance every time.

Clause 3: The hard stop

The third clause is the one most people skip, and it is the one that lets you give the agent more rope, not less.

My content agent drafts and stages. It never publishes. It writes the post, writes the channel versions, writes the image prompt, and puts them in a folder for me. Then it stops and waits. Nothing reaches the public until I say the words.

People assume a hard stop means you trust the agent less. It is the opposite. Because there is a gate I control, I am comfortable letting the agent do far more on its own. It can draft a whole week of content unsupervised, because the worst case is a bad draft sitting in a folder, not a bad post in front of my readers. The stop is what makes the autonomy safe.

This is the same instinct I used to build a persona feature tester with Claude. Let the AI run wide and generate, then put a human checkpoint exactly where a mistake would cost something real. Wide where it is cheap. Narrow where it is expensive.

Put the gate at the irreversible step. Drafting is reversible. Sending is not. Spending money is not. Changing a price a customer sees is not. The agent gets the reversible work. I keep the one-way doors.

What I am doing this week

I am resisting the urge to tune. When a draft comes out wrong now, I have a new first question. Which clause failed? Usually, it is the source. A note in the wrong place, or a fact I never wrote down. I fix the file, not the prompt, and the next run is right.

I am also writing the contract before the agent, not after. The next thing I hand off, I am drafting the three clauses first on a single page. Where it reads from. What it must never do. Where does it have to stop? If I cannot answer those three in writing, the task is not ready to be delegated to an agent or an individual.

That is the part that surprised me. The Agent Contract is just good delegation, written down. We have always known how to hand work to a person we trust. Give them one place to look, clear rules, and a point past which they check with you first. The agent did not change the job. It removed every shortcut I used to get away with.

Related reading from PMJ

FAQ

What is an AI agent, in plain terms? A program that uses an AI model to do a multi-step task on its own, reading inputs, making choices, and producing output, instead of answering one question at a time. The risk is not the model. It is everything you let it touch without checking.

What is the Agent Contract? Three things you write down before you trust an agent with real work. One source of truth it reads and writes. Constraints in writing cannot be ignored. A hard stop before any irreversible action. Get all three, and you can hand off a lot. Miss one, and you cannot safely hand off anything.

Do I need to code to build one? No. I do not. Every clause here is written in plain language in plain files. The hard part is not technical. It is being specific about what the thing must never do and where it has to stop, which is the same discipline behind a good PRD for agents.

My agent keeps getting facts wrong. Where do I start? The source clause, almost always. If the agent is wrong and you cannot name the exact file to fix, your context is scattered. Pull everything it reads into one place before you touch the prompt.

Isn’t a hard stop just slower? Slower on the last step, faster everywhere else. The gate is what lets you run the agent unsupervised on all the work before it, because a mistake lands in a draft folder instead of in front of a customer. You trade one click for a lot of autonomy.

What is the one thing to do this week? Pick one task you keep meaning to hand off. Write the three clauses for it on a single page before you write any prompt. If you cannot fill in all three, that is your answer about whether it is ready.

Dan Blizinski is the founder of Trevean Spice and writes The Product Manager’s Journal, where he covers PM frameworks grounded in actually building things.