Production patterns

Bound every run

Define turn, tool-call, elapsed-time, and token budgets. Cancellation should propagate through model calls, streaming, and tool execution rather than being simulated in application code.

Make side effects resumable

For long-running work, pair checkpoints with an append-only event history and stable idempotency keys. Retries and resumed runs can then reuse earlier side-effect results instead of duplicating them.

Execute code behind a sandbox

Command and code execution belongs behind an injected sandbox boundary with explicit workspace, resource, and network policy. Agent RT supports restricted native execution, Docker, and optional managed/remote backends; unsupported isolation requirements should fail closed.

Observe and evaluate

Production operations include traces, logs, metrics, usage/cost accounting, deterministic graders, model judges, tool-use and trajectory grading, safety suites, golden datasets, and controlled experiments.

Separate deployment from agent logic

Deployment and optimization primitives cover configuration overlays, feature flags, prompt rollout/rollback, workers, quotas, schema migrations, caching, batching, latency optimization, and multiple deployment targets. These concerns can evolve without changing the agent's provider-neutral core contracts.

Review privacy before launch

Map what prompts, files, tool results, sessions, checkpoints, and traces your service sends or retains. Disclose the actual providers and retention/deletion behavior, restrict access, and redact sensitive content before exporting it. The documentation site's privacy noticeDeployment checklist applies to this static site; an app built with Agent RT needs disclosures for its own data flows.

• Signup and children: review the audience and applicable children's privacy rules before collecting personal data. An age checkbox is not parental consent, and general-audience sites are not universally required to ask every visitor's age.
• Assets: keep fonts, scripts, styles, and media local; review external requests before adding integrations.
• Recording: keep analytics and session replay disabled by default. Review notice and consent requirements before enabling collection; exclude prompts, credentials, and private inputs.
• Marketing: use accurate sender details, a valid postal address, and a tested unsubscribe/suppression flow before sending promotional email.
• Subscriptions: disclose price, billing interval, trial conversion, renewal terms, and cancellation before purchase; record affirmative consent and test cancellation and required notices.
• User content: review permissions, takedowns, counter-notices, repeat-infringer handling, and any required agent designation/registration before hosting submissions.

The public Agent RT site currently has no signup, recording, marketing list, billing, or visitor uploads. See the deployment privacy and launch checklist for implementation review points and official references. These controls support review of your service; they do not establish legal compliance by themselves.