The short answer
A playbook an agent can follow is a contract with five parts: the goal, the authority bounds, the inputs it may trust, the escalation rule, and the record it must leave. Write all five and you have something an agent can execute and a person can audit. Skip the bounds, which is what almost everyone does, and the agent will invent them for you.
Most people treat this as a prompting problem. It is very rarely a prompting problem.
The instructions that fail are usually written like a job description for a new hire. A new hire fills the gaps with judgment and asks a colleague when the situation is unfamiliar. An agent fills the gaps with whatever the instruction most resembles, and it does not ask.
Gartner reported in June 2025 that more than 40% of agentic AI projects will be cancelled before the end of 2027. Very little of that will be caused by model quality. Most of it will be caused by instructions that never said what the thing was allowed to do.
Why do most AI agent instructions fail?
They describe the task and omit the boundary. "Follow up with opportunities that have gone quiet" is a task. It does not say whether the agent may offer a discount, whether it may write to someone who opted out of marketing, how many times it may write before it stops, or what it should do when the account already has an open support ticket.
Nothing in that instruction is wrong. Everything expensive lives in what it left out.
The second failure is subtler. The instruction says what good looks like but never says what the agent should do when it cannot tell. Ambiguity is the normal case in revenue work.
What are the five parts of an agent playbook?
| Part | The question it answers | Weak version | Usable version |
|---|---|---|---|
| Goal | What outcome are we checking in two weeks? | "Improve engagement with inbound leads" | "Every inbound enquiry gets a substantive first reply within five minutes, and 90% of replies go out unedited" |
| Authority bounds | What may it do without asking? | "Use good judgment" | Two explicit lists of verbs: may send, may book, may update. May not discount, may not promise dates, may not write to accounts in renewal |
| Trusted inputs | What may it treat as fact? | "Use the CRM and the website" | Ranked sources, with a staleness limit and a rule for missing data |
| Escalation rule | When does it stop and hand over? | "Escalate if unsure" | Named triggers, a named owner, and a defined holding action |
| The record | What must it leave behind? | Task marked complete | Action, inputs used, rule applied, and what it decided not to do |
Part one: a goal with a number in it
One sentence. One outcome you could check with a query.
"Improve lead engagement" cannot be checked. "Every inbound enquiry receives a substantive first reply within five minutes during business hours" can be checked on Friday. The goal exists so that in two weeks you can say whether this worked.
If you cannot name the number that should move, the rest of the playbook is decoration.
Part two: authority bounds, written as verbs
Two lists. What it may do without asking, and what it may never do without a person.
A workable set for an inbound response agent looks like this. May: draft and send a first reply, answer questions covered by the published documentation, book into calendar slots already marked bookable, update contact fields it can source from the enquiry itself. May not: quote any price not on the current price list, commit to a delivery date, write to more than three people at one company in a week, contact any account flagged as in renewal or in legal review.
Write the second list first. It is shorter, and it is the one that decides whether anyone will let the agent run unsupervised.
Does restricting an agent make it less useful?
The best available evidence says the opposite, and it is worth quoting precisely because the intuition runs the other way.
Karlinsky-Shichor and Netzer, in Marketing Science 2024, studied 17 sales representatives and 67,851 quotes. A human-machine hybrid, where the model recommended a price and the representative kept the decision, returned 7.8% higher profit. Full automation returned 4.9%. The bounded version beat the autonomous one by nearly three percentage points of profit on the same task.
The same study found the assistance was worth $14.85 per quote for low-expertise representatives and $5.21 for high-expertise ones. Bounded help is worth most to the people who need it most, which matches Brynjolfsson, Li and Raymond's finding in the Quarterly Journal of Economics 2025 across 5,179 support agents: +14% on average and +34% for novices. Experienced staff gained close to nothing.
Luo, Qin, Fang and Qu, in the Journal of Marketing in 2021, ran three randomised field experiments across 980 sales agents at two fintech firms. An AI coach that delivered unrestricted feedback helped the weakest agents least, because they hit information overload. Restricting how much feedback the system was allowed to deliver improved their outcomes. The constraint was the intervention.
Bounds are the part people cut because they read as a limit on the technology. They are the part that makes the technology usable.
Part three: the inputs it may trust
Name the sources and rank them. The CRM record above the enrichment provider. The signed contract above the CRM. The customer's own words in the thread above everything.
Then set two rules people forget. A staleness limit, so that a job title sourced more than ninety days ago is treated as a claim rather than a fact. And a missing-data rule: when the agent cannot find something, it says so and stops. It does not infer. An agent that guesses a job title will eventually address a procurement lead as the head of engineering, in writing, on a Tuesday.
Part four: an escalation rule made of triggers
"Escalate if unsure" is not a rule. Machines are not unsure in a way you can read off.
Write triggers instead. The prospect asks for a price outside the published band. The thread mentions legal, security or procurement. The same question is asked twice without resolution. The account is above a stated annual value. Anything involving a refund, a cancellation, or a promise about a date.
Then write the other half, which is the half people leave out. Where the escalation goes, who owns it, how fast they must answer, and what the agent does while it waits. Usually the answer is to acknowledge the person and commit to a reply time. Then stop.
Part five: the record it must leave
For every action: what it did, which inputs it used, which rule it applied, and what it decided not to do. That last field is the valuable one, because omissions are invisible otherwise.
An agent without a record cannot be corrected. An agent with one can be, and reading the record is the work.
The record is also how you answer the finance question later. In Gartner's survey of 227 chief sales officers, 31% named difficulty proving the return on AI tools as a top challenge for the year. A written record of what the agent did, and what it declined to do, is the cheapest route to that proof.
What the evidence does not settle
No study compares written agent playbooks against unwritten ones. The bounded-beats-autonomous result comes from pricing decisions and sales coaching, not from instruction design, so the transfer is an inference rather than a finding.
What is measured is narrower and still useful. Constraining a system's authority beat removing the constraint in both settings where somebody ran the comparison properly. That is a good reason to write the bounds down. It is not a promise about your number.
Write the five parts for one process. Run it for two weeks. Read the records, not the summary.