The narrow-task-first advice is right and the boundary section is where most pilots die. I always start agents read-only and graduate permissions one at a time, and the metric that decides promotion is a clean run rate on a fixed task set, not a demo. How many permission levels do you run before an agent can write to production systems?