Before he joined Nubank in 2025 to build agents for the Brazilian bank's hundred-million-plus customers, Aman Gupta spent a decade on systems that make many small decisions correctly: infrastructure automation at Amazon, computer vision at Apple, ranking and recommendation at LinkedIn. The paper his team published this year describes what they deployed. The engineering is careful. What interests me is the pattern in the choices, which the paper doesn't comment on.
Almost every one of them takes something away from the model. Each agent gets a narrow toolset, typically five to fifteen tools. Human standard operating procedures are translated into ordered routines. Where a sequence of steps is fully deterministic, the team collapses it into a single composite tool rather than letting the model plan the sequence each time. Tool outputs are kept narrow. Action APIs are built to be idempotent, so a retry produces the same result as the first call and nobody gets charged twice. What's left for the model is understanding what the customer is asking, choosing the routine that fits, and recognizing when to stop.
A persistent scratchpad holds collected parameters, tool outputs, and the current step of the active routine. Rollout starts on limited traffic and widens as the team watches satisfaction, escalation rates, and error signals.
Three conditions send a case to a human: the request falls outside the defined routines, data retrieval fails, or the agent's confidence is low. In each case, the paper says, the human receives "full context preserved."
The architecture doesn't say what that consists of. The paper doesn't describe a handoff payload, specify which fields the person sees, or distinguish between what the agent recorded to continue its own work and what someone else would need to take over. The audit trail captures tool-call inputs, outputs, latency, and errors, but the paper presents it as a compliance and debugging record rather than something assembled for a person picking up a live conversation.
The scratchpad records parameters and routine steps — state organized for the agent's next action. A person arriving mid-case needs to see which commitments have already been made, what remains unresolved, what the customer understands has happened.
The three escalation conditions produce three quite different situations for whoever answers. An out-of-routine request means the customer wants something the system was never built to do; the agent has probably committed to nothing. A retrieval failure means the agent may have told the customer something it can no longer verify. Low confidence means the agent may already have acted, and acted wrongly. One phrase covers all three, and the person on the receiving end has to reconstruct which one they're in. That reconstruction is work the architecture could do for them.
None of this reads as an oversight. Gupta's team put substantial engineering into bounding what the agent does on its own, which is the problem production traffic forces you to solve first. Nothing on a roadmap rewards building the resumption artifact until a handoff fails badly enough to need explaining afterward.
His QCon talk and a co-authored engineering post both frame the system as an infrastructure problem, which fits where he came from. Ranking systems teach you that a model prediction is cheap on its own and expensive in aggregate, because the errors compound across millions of impressions. Model judgment becomes something you ration. Read that way, the agent design is the same discipline applied to a domain where the errors move money.
So the architecture is precise about where the model's authority ends. What travels back across that line when a person resumes the case is still an open design question, and it may turn out to be the harder one.
- How production agents behave: A peer-reviewed field study of 86 deployed and pilot agent systems found that 68% ran ten steps or fewer before human intervention and 74% relied primarily on human evaluation rather than automated benchmarks.
- Handoff without stored context: Berkeley's AgentWatch project tested browser-based agents using fresh profiles with no history, credentials, or memory, acknowledging that this controlled setup differs significantly from real delegated browsing where accumulated identity makes actions consequential.
- Unresolved delegation questions: The September W3C/GS1 workshop agenda on e-commerce for humans and AI agents lists authority, scope, revocation, and the final check before an action creates an external effect as open participant-proposed topics.
- Safety documentation gaps: The 2025 AI Agent Index examined thirty prominent deployed agent products and found that twenty-five disclosed no internal safety results, with most documentation stopping at a different system boundary from the one producing the consequential action.