Define done before the agent starts.

Name one durable artifact

Start with the thing that must exist when the task ends: a versioned file, a published page, a tested integration example, or a decision record. Avoid making activity the deliverable. "Research competitors" is activity; "save a source table with a dated go/no-go decision" is an artifact.

Write the boundary in plain language

• List the files, systems, or accounts the task may change.
• Exclude irreversible or unrelated actions.
• Name the data the task may use and what it must not collect.
• Set a time, cost, or attempt limit when work can branch.

NIST's AI Risk Management Framework treats governance as a cross-cutting function and calls for clear roles, responsibilities, policies, and documentation. A task boundary turns that general principle into something an operator can inspect.

Make acceptance observable

Acceptance criteria should be testable by someone other than the worker. Prefer a command, public URL, checksum, screenshot, or API read-back over a sentence saying the task "looks good." Match each important claim to evidence.

• The build command exits successfully.
• The public URL returns the expected status and content type.
• A narrow mobile viewport has no horizontal overflow.
• The browser console has no errors during the main action.
• Recorded metrics contain observations, not estimates presented as facts.

Add stop and escalation conditions

Stop when the task reaches its acceptance criteria, when a stated limit is reached, or when the next step needs authority the worker does not have. OWASP's guidance for agentic applications includes least privilege, tool-use controls, and human approval for high-impact actions. A stop condition is where those controls become operational.

Copy this task shape