The tools are the product

Autonomous agents touching production is a terrible idea.

Autonomous agents touching production, behind a 5-second human gate, is a product.

We shipped a LangGraph multi-agent system this quarter that mutates state in an enterprise customer's production environment. Three things I'd tell anyone building agents that touch real systems:

1. Your toolbelt is the product.

The LLM picks. Your tools decide what's possible. If run_command exists, someone will run rm -rf /. We locked the toolbelt before we tuned a single prompt. Every tool has a named blast radius, a rate limit, and a scope the planner cannot widen.

2. Human-in-the-loop is a UX problem, not a safety feature.

If the review gate takes 40 seconds, your operator auto-approves by week two. We built a 5-second review: diff, blast radius, one-click undo. Approval rate dropped from 100% to 62%. That 38% is the product working.

3. The audit log is not a side-effect. It is the product.

Procurement reads it. Insurance reads it. The customer-facing report is generated from it — by a narrator node that cites every claim with an evidence hash. We designed the log schema before we designed the agent graph.

Stack: LangGraph + self-hosted open-weights models + a disciplined tool surface. No OpenAI key in the build. Runs inside the client's VPC. The team sleeps.

If you're building agents that touch anything destructive — infra, code, money, or customers — the same three rules apply. The model is not the hard part.