Start with the job, not the persona
State the result, the boundaries, and the source of truth before adding voice. A role can focus behavior; it cannot replace permissions or evidence.
Name the six working parts
- Intent — the outcome and the definition of done.
- Inputs — accounts, records, time range, and missing setup choices.
- Guardrails — untrusted-content rules, sensitive-data limits, and stop conditions.
- Actions — what may be read, drafted, or changed, and what needs exact approval.
- Output — the format, citations, uncertainty, and action log.
- Test — one supervised example with acceptance criteria.
Test the edges
Use a normal case, a missing-source case, and an instruction hidden inside retrieved content. A reliable agent should complete the first, fail closed on the second, and flag the third as untrusted.
Evidence note: a fluent answer is not proof of a correct source, permitted action, or successful write. Ask for those separately.