Pass the tests and the agent has proven one thing: it can reason about a world that held still while it thought.
Production does not hold still.
The failure lives in the gap between plan time and act time. The agent reads state, spends seconds or minutes forming a plan, then acts, and by then the payment settled, the balance moved, the document picked up another signature, the catalog item was repriced. The reasoning was correct for a state that no longer exists. Evals miss it, because a fixture is frozen by definition.
Three things change the outcome, and none of them are about the model.
Every read the agent is allowed to act on carries a version. If the version moved, the write gets rejected, and the agent re-plans instead of overwriting someone else's truth.
Idempotency keys come from the intent, not from the attempt. A retried agent step converges on one effect rather than two: the same discipline payment rails have needed since long before agents existed.
Each action re-validates its own precondition at execution time instead of trusting the plan that produced it. The plan is a proposal. The action layer is the authority.
The real shift is in how you read the thing: an agent is a slow, concurrent, retrying client of your system, so it needs the guarantees you would give any other such client. Most production agent failures I see are ordinary concurrency bugs wearing a new costume.
More on this on the blog: https://polycratia.com/c/0fa23d3a
So if you run agents against live state, you are doing one of two things: versioning the reads, or shortening the window and hoping...