Your AI Agent Needs a Job Description Before It Gets a Plugin
Your AI Agent Needs a Job Description Before It Gets a Plugin
AI agents are leaving the chat window.
Agents are starting to sit inside the places where work already happens: business apps, dashboards, docs, spreadsheets, creative tools, customer records, and shared internal sites.
OpenAI’s June 2 Codex announcement is a clean example. OpenAI says Codex has more than 5 million weekly users, with non-developers at about 20% of users and growing more than 3x as fast as developers. The update adds role-specific plugins, Sites, and annotations for work across tools and workflows (source).
Good. Also: this is where normal users need better habits.
Because a plugin is not magic. A plugin is access.
If your agent gets a sales plugin, it may see customer records. A data plugin may see metrics. A creative plugin may touch brand assets. A workspace plugin may draft work other people will see.
That does not mean you should panic. It means you should stop treating the agent like a vague all-purpose assistant.
Give it a job description.
Access needs a job
Most people give agents instructions that are too broad: “Help me with sales,” “Organize my business,” or “Use my tools and make this better.” Those make the agent guess what job it owns, what it may change, when it should ask, and what counts as finished.
The fix is plain-English management.
Tell your agent: “Before you use this plugin, I want to define your job. Complete one narrow workflow, using only the tools and information I name. Stop when the job is done or when you hit an approval rule.”
You are not giving the agent the keys to “the business.” You are assigning a worker to a role.
The Job Description Pattern
Use the same pattern every time: job name, outcome, allowed tools and data, actions allowed alone, actions that require approval, stop conditions, and handoff format.
Tell your agent: “Your job name is [name]. The outcome is [specific result]. You may use [tools and data]. You may do [safe actions] without asking. You must ask before [sensitive actions]. Stop if [risk, confusion, missing access, or approval needed]. When you finish, leave a handoff with [summary, changes, open questions, risks, and next step].”
You can use it for a sales plugin:
Tell your agent: “Your job is account prep. The outcome is a short briefing for tomorrow’s customer calls. You may read CRM notes, recent emails, and meeting history for the named accounts only. You may summarize and draft talking points without asking. Ask before updating the CRM, sending messages, changing deal stages, or making promises. Stop if customer data is missing or sensitive. Leave a handoff with key context, risks, and decisions needed.”
Notice the pattern: small job, named tools, clear permission, approval line, stop rule, useful handoff.
Approval is not micromanagement
People sometimes avoid approval rules because they want the agent to feel autonomous. Wrong target. Autonomy means working independently inside clear boundaries.
Your agent should not need permission to summarize five customer notes. It should need permission to email the customer or promise a discount.
Tell your agent: “You may read, summarize, draft, sort, compare, and prepare recommendations without asking. Ask before sending, publishing, deleting, buying, changing records, changing permissions, contacting people, making commitments, or doing anything customer-facing, financial, legal, or hard to undo.”
That is not fear. It is basic operating discipline.
Give It Stop Conditions
Agents like to keep going. That can turn one bad assumption into a chain of polished nonsense. Give the agent permission to stop.
Tell your agent: “Stop and ask me if the data conflicts, the source is missing, the task touches sensitive information, the action affects another person, the next step is hard to undo, or you would need to guess what I want.”
This matters more with plugins because the agent may be able to create, update, move, send, or share. Easy action needs clear brakes.
Require a Handoff
The final output is also the trail it leaves so you can judge the work.
Tell your agent: “When you finish or stop, leave a handoff with six sections: outcome, sources used, actions taken, approvals needed, risks or uncertainties, and the next decision for me. Keep it short enough that I can act on it quickly.”
Then review the handoff before widening the job:
Tell your agent: “Review your handoff against the job description. Did you stay inside the allowed tools and data? Did you take only the actions allowed without approval? Did you stop where the rules said to stop? List anything I should tighten before I run this workflow again.”
That is how you improve the system without becoming technical. You are teaching the agent how you want work handled.
Start smaller than feels impressive
The temptation is to connect everything and ask for a miracle. Start with one narrow job, one plugin, one outcome, and one approval line.
Tell your agent: “For this first run, use only the plugin needed for this one job. Do not pull in other apps, files, channels, or workspaces unless I approve. Complete the narrow task, leave the handoff, and suggest one improvement to the job description for next time.”
That is the operator’s move.
The future of agents is not one giant assistant with vague permission to roam through your business. It is a set of narrow workers with clear jobs: account prep, inbox triage, weekly reporting, customer research, and meeting follow-up.
Each one gets a job description before it gets access.
If you are still setting up your first agent workflow, start with the OperatedBy.AI quickstart. Pick one job your agent can own, write the rules in plain English, and make the handoff part of the work.