What you can rely on
Four things the runtime promises you can observe for yourself — work resumes instead of repeating, anything irreversible waits for you, an action outside what you granted is refused before it happens, and every run is readable afterwards.
Most of what an agent does is judgement, and judgement is not a promise anybody can make. These four things are different: they are properties of the runtime rather than of the model, they hold whatever the model decides, and you can check each one yourself.
Work resumes; it does not repeat
If a run is interrupted — the process stops, the machine reboots, the network drops — it picks up where it stopped instead of starting over.
The part that matters is what happens to work that already reached the outside world. A message that was sent, a ticket that was filed, a row that was written: those are not done a second time. A run that was interrupted halfway finishes in the same state as one that was never interrupted.
Why this is the hard one
Retrying is easy. Retrying without re-sending the email is the difficult part, and it is the reason a run is recorded step by step as it goes rather than replayed from the beginning.
Anything irreversible waits for you
An agent can read, think, search and draft on its own. Before it does something you cannot take back, it stops and asks — and the run holds there until a person answers.
You choose what counts as irreversible, per run or per trigger. See approvals.
An action outside what you granted is refused before it happens
Not undone afterwards — refused, before anything runs.
A model can propose any tool call it likes. Whether it happens is decided by the runtime's own check against what you granted that run: the exact tool, the exact version, the folder it may touch, the address it may reach, and the credentials it may use. Every one has to pass. The model's confidence is not an input to that decision.
A refusal is not a crash. The step settles as refused, with the reason, and you can read it back.
Every run is readable afterwards
You can see what an agent did, in order, after the fact: which step ran, what it reached for, what came back, what was refused, and where it stopped. Not a log you have to grep — a record the console renders.
See seeing what happened.
What these do not cover
The model's judgement is not one of the four
None of the above makes an agent correct. A run can resume perfectly, wait for approval politely, respect every grant, keep a complete record — and still have drafted a bad answer. The four guarantees are about what the runtime does with an agent's decisions, never about the decisions.
They also say nothing about capacity, latency or availability. For what the runtime does not do yet, stated without softening, read production notes and limitations.