Pramod Krishnan says enterprise agents should earn autonomy through assistant, recommendation, and gated-action stages.
2
Agents need controls for identity, inputs, outputs, and auditability before they can operate in production.
3
FinOps must track agent spending at run, workflow, and agent levels because autonomous workflows can recurse and overspend quickly.
Summary
Pramod Krishnan explains why agents that take actions need stronger controls than systems that only answer questions. He classifies work as reversible, sensitive, or consequential, then maps each category to different approval and testing requirements. His production framework covers agent identity and credentials, prompt-injection defenses, allow-listed tools, output limits, rollback paths, audit logs, evaluations, and cost controls. He describes auditability across quality, P99 performance, safety, cost, and business impact. The discussion uses OpenClaw as an example of the gap between autonomous-agent demonstrations and enterprise operating requirements, including exposed API keys and security vulnerabilities. Pramod also argues that humans should own the outcomes and system designs behind agent-generated work. In his view, agents can let one person operate at the level of a pod, but organizations must redefine roles, train employees, and assign accountability rather than treating people as passive reviewers.
Agents increase the consequences of mistakes when they can act
Pramod Krishnan says the boundary of what an agent can get wrong grows when it moves from conversation to tool use. A user answering a question remains the person acting on the information, while an autonomous agent can make changes on its own. He gives coding agents as an example: asking an agent to revise code can lead it to delete code that someone had already reviewed and tested. Enterprises therefore need to ask whether they have the controls and guardrails to match the model's capability before allowing the agent to act.
Work should be classified by reversibility and blast radius
Pramod Krishnan groups agentic work into reversible, sensitive, and consequential categories. Reversible work includes enriching an incident ticket, summarizing it, or producing a root-cause analysis that a human engineer can undo or revise. Production changes and actions that affect system stability are sensitive, so they need tighter approvals, controls, and testing. Consequential work includes touching customers, policy documents, or legal documents. These tasks have a larger blast radius and need stronger gatekeeping.
Autonomy should increase gradually through earned stages
Pramod Krishnan describes autonomy as a spectrum. An agent starts in assistant mode, where it answers questions using approved tools. It can then move to recommendation mode, where it proposes actions without taking them. The final stage is gated action, where the agent executes with approval at each stage. He says the agent should earn its way forward and should be able to move back to an earlier stage when its behavior or results require it.
The guardrail stack begins with identity and ends with auditability
Pramod Krishnan treats an agent's credentials as a first-class control. Credentials need appropriate authorization, expiration, protection, and cybersecurity checks. Input controls defend against prompt injection and restrict tools to an allow-list that has been scanned and governed. Output controls limit toxic or non-compliant output, tool-call counts, retries, and the damage that can occur before rollback. Auditability requires records of what changed so a human operator can trace a transaction later.
Pramod Krishnan says tools such as LangFuse and OpenTelemetry can provide useful traces, but his auditability framework adds focused evaluation. He checks quality with predefined use cases and an LLM-as-judge approach. He examines P99 performance instead of only median or mean latency, then evaluates safety through measures such as PII redaction and filters. Cost should be measured at each run, and business-impact decisions should be logged in a system of record so the agent's actions remain traceable.
Agent logs should drive continuous revision of the use case
Pramod Krishnan treats deployment as an ongoing activity. If an agent built for root-cause analysis starts receiving a wider set of problems from the same users, its logs can show which additional tools and reasoning paths are needed. The same records show where tasks complete successfully and where the agent fails. Input and output guardrails also reveal questions outside the agent's current capability. The agent should say it cannot answer rather than hallucinate, while the unanswered request becomes evidence for future work.
OpenClaw shows the risk of unrestricted agent access
Pramod Krishnan says OpenClaw and Agent Zero demonstrate what fully autonomous agents can do, including agents conversing with one another through Moltbook. He also describes serious security problems associated with the movement. He says about a million user API keys were exposed, tools were created to phish API keys, and a Kaspersky audit found more than 500 security vulnerabilities. Risks that may be tolerable for an individual can compound in an enterprise because the blast radius is larger.
Production readiness combines controls, evaluations, and FinOps
Before production, Pramod Krishnan wants three parts in place: a control plane, an evaluation layer, and FinOps discipline. The control plane covers identity, input controls, output controls, and auditability. Evaluations cover quality, performance, safety, cost, and business impact. FinOps sets budgets at the run, workflow, and agent levels, while also limiting tool calls, recursion depth, and execution time. Model selection is part of cost control, since simpler tasks may use simpler models while tool calling may require more capable ones.
"The ownership part of it means that the system design behind it or the thought behind it or the blueprint behind it, the DNA behind it is yours."Pramod Krishnan41:26
Who should watch
You are deciding whether an agent can move from an internal experiment into production and need a practical approval and control model.
Your team is struggling to forecast agent costs, especially when workflows can recurse or make many tool calls.
You are responsible for security and want to understand why agent credentials, third-party tools, prompt injection, and abnormal behavior need separate controls.
