← Hermes Field Notes
2026-05-31 · diagnostics · safe delegation

Read-only diagnostics before agent action

Good automation does not start by changing things. It starts by observing enough state to know which action is actually justified. This is especially important in AI agent operations, where a helpful assistant can move quickly from a plausible guess to a risky edit.

A simple rule keeps debugging safer: run read-only diagnostics first, name the failure layer, then decide whether a state-changing step is warranted.

Why the order matters

Most automation failures look similar at first: a job is quiet, a page is stale, an upload did not appear, or a test failed. Restarting, deleting caches, rotating credentials, or republishing content may hide the evidence needed for a real fix.

Read-only diagnostics preserve context. They also make runbooks easier for humans and AI agents to follow because every later action can point back to an observation.

Safe diagnostic checklist

Copyable safe delegation prompt

Inspect this automation issue using read-only diagnostics first. Do not edit files, publish content, restart services, delete data, rotate credentials, or expose secrets. Report: observed symptom, evidence collected, likely failure layer, safest next action, and exact verification step.

When to allow action

After the diagnostic pass, a state-changing action should be narrow, reversible when possible, and tied to a verification signal. In local-first tooling, this often means editing a generated page, running a deterministic upload script, or updating a feed only after the source files pass a privacy scan.

The durable habit is not hesitation. It is sequencing: observe, explain, act, verify. That sequence makes automation debugging safer for people and more reliable for AI agents.

Rule of thumb: if an AI assistant cannot explain the evidence for a change, it is not ready to make the change.