The agent could investigate, but it could not decide.
The Question Investigator had one job: investigate an unresolved State Question and return evidence plus a suggested answer for human review. It could search approved project material, but it had no authority to change State or resolve anything itself.
Five controlled cases tested more than whether the agent could find a file.
The agent had to search across the available project record rather than stop at the first plausible match.
Pending proposals had to stay pending. Individual agreement could not become group approval, and conflicting evidence had to remain visible.
The output could suggest an answer and a next step, but it could not resolve the Question or treat a proposal as accepted Current State.
This was a small learning exercise using fake project data. The five cases are not a production performance claim.
One case failed even though retrieval was correct.
Priya Shah had offered to own customer support training, Devon was listed as backup, and an open Review proposed the assignment. Current State did not establish the owner yet.
The answer said Priya owned the training and implied broader acceptance. That crossed the product's authority boundary even though the supporting records had been retrieved.
The trace showed the agent had found the relevant sources and recognized the open Review. The failure appeared when it combined those facts into a stronger conclusion than the evidence supported.
I changed the instruction at the layer that actually failed.
The fix made the authority boundary explicit. Open Reviews remain proposals, and agreement from one person does not establish a group decision. I reran the exact same Q-103 case; the agent then correctly said ownership was not established and directed the reviewer to the open Review.
Read-only tools reduce action risk, not interpretation risk.
An agent can be unable to write anything and still give a overconfident interpretation. Tool restrictions and answer-quality safeguards solve different problems.
The final bad answer did not reveal whether retrieval or synthesis failed. The trace showed the sequence well enough to identify the first observable wrong step.
A changed prompt is not evidence of a fix. Repeating the exact failed case showed whether the targeted change actually corrected the behavior.
The useful agent skill was deciding what the agent should not be allowed to conclude.
I kept human approval mandatory and required the investigator to show the evidence behind its suggestion. I also left out a user-facing confidence score because it could bias the reviewer. The exercise reinforced the same State principle I use elsewhere: AI interprets, software enforces, and people authorize.
What I did vs. what AI did
I chose the use case and authority boundary. I judged the test cases, identified Q-103 as an authority failure, and decided what the fix needed to preserve.
I used AI to draft the agent instructions and fake dataset, help run the controlled exercise, review the traces, and implement the targeted instruction change.