It is only a client.

Many teams hear "agent" and start rebuilding infrastructure. In practice it needs what your system already has: a set of interfaces, an authorisation model, an audit log.

Attach the agent as one more client and it inherits every constraint those years bought you. Bypassing them to stand up something parallel is the genuinely dangerous move.

Idempotency is the floor.

An agent retries. It retries on timeouts, on parse failures, and because it "felt" the call did not land.

So every tool it can reach is either naturally idempotent or takes a caller-generated deduplication key. Without that, the first production incident is only a matter of time.

Start read-only.

For the first month, grant queries alone. Let it answer questions, draft text, and organise data — and let it change nothing.

In that month you will see every strange idea it has, and the cost is a few useless log lines. Once you can predict its behaviour, open write operations one at a time, each paired with a record you can undo in a single click.