How to write AI agent instructions: a goal it can finish

Good AI agent instructions describe the finished result, not the steps. Say what the result is and who it is for. List the sources and tools the agent may use, and what it must not do. Then say how you will check it is done, and when it should stop and ask you.

How do you give an AI agent a goal?

You describe the result you want and let the agent choose the steps. A goal is a short statement of an outcome, such as “a one-page sales summary for Monday’s meeting”. A prompt is a single request. Instructions are the rules that surround it.

For a business lead, the useful unit is the goal. If the idea is new, our post on what agentic AI is explains how an agent plans toward a goal.

The rest of this post uses one running example. Your team wants a weekly sales summary built from a shared targets spreadsheet and a CRM export. Both files are internal to your company.

What should AI agent instructions include?

A finishable goal has five parts, and each one answers a question the agent cannot guess.

1. The result and who it is for. Name the thing you want, the person who will read it and where it should land. “A one-page summary for the sales manager, returned to me” beats “report on sales”.
2. What it may use. List the exact spreadsheet, the CRM export and any other source. Say that anything not listed is out of bounds, then back that up with access settings.
3. What it must not do. Say what stays untouched, such as changing figures in the spreadsheet or sending the summary to anyone.
4. What done looks like. Write a one-minute check, such as “every region shows its target and its actual, and each actual matches the export”.
5. When to stop and ask. Name the cases where the agent should pause, such as a missing column or two sources that disagree.

OpenAI’s practical guide to building agents (read in November 2026) is written for teams that build agents. It suggests writing agent routines from documents you already have, such as operating procedures and policy documents. If your team has a checklist for the weekly summary, start the goal from it.

If you want to try this on a real task, our post on starting your first agent from a template shows one way in.

What does a finishable goal look like?

A finishable goal turns each of those five parts into a sentence someone could check. The table shows the weekly sales summary before and after.

The finishable version is longer, but it still fits in a short paragraph. You do not need a page-long master prompt.

Why do AI agents fail to finish?

One reason, in our view, is that the goal gives no way to tell progress from a stall. Anthropic’s guide to building effective agents, published in December 2024, says an agent should gain “ground truth” from its environment at each step. Tool call results are one example. The agent uses them to judge progress. An agent with no finish line has nothing to check against. Our post on what happens after you type a request walks through that loop.

The same guide says agents can pause for human feedback at checkpoints or when they hit blockers. It adds that it is common to include stopping conditions, such as a maximum number of iterations, to keep control. In our view, a goal that never says when to stop leaves the agent to guess.

The guide also warns that the autonomous nature of agents means higher costs and the potential for compounding errors. One wrong figure early in a run can carry through to the final summary.

OpenAI’s guide covers the human side of the same problem. It tells builders to capture edge cases, such as incomplete information. It also says to set limits on agent retries or actions, and to hand over to a person once an agent exceeds them. Those limits belong in the tool’s settings where it has them. Your goal’s fifth part says what counts as stuck.

Missing access stops a run too. If the agent cannot open the spreadsheet, no wording will help.

Where do limits belong, in the goal or in the settings?

They belong in the tool’s settings and access first, and in the goal second. A sentence in the goal says what you want. It does not stop the agent from doing something else.

The OWASP GenAI Security Project lists ways to reduce the impact of prompt injection in its LLM01:2025 entry, and two of them apply here. One is to restrict the model’s access privileges to the minimum necessary for its intended operations. The other is to require human approval for high-risk actions.

OWASP also describes indirect prompt injection. It happens when a model accepts input from external sources, such as websites or files. That content can change how the model behaves in ways you did not intend. Even internal files can hold outside text, such as notes or form entries in a CRM export that customers typed. Keeping the agent to read access limits what injected text can make it do. A task that reads web pages or outside documents needs more care.

OpenAI makes a similar point about high-risk actions. It says sensitive or irreversible actions, such as payments, should trigger human oversight until you trust the agent’s reliability.

So when you write “do not edit either file”, also check the tool you use. Give it read access to the two files and no write access. It only needs to return the summary to you. If the tool can ask you before it sends or changes anything, switch that on. Check what your own tool offers, because settings differ from one product to the next.

Is an AI agent always the right choice?

No. Anthropic’s guide recommends finding the simplest solution possible and increasing complexity only when needed. It adds that this might mean not building agentic systems at all.

The same guide says agents suit open-ended problems where it is hard to predict the number of steps. It says workflows offer predictability and consistency for well-defined tasks, such as a job with the same steps every week. In our view, a person still suits a job where a wrong answer is costly.

If your weekly summary follows the same steps every week, a fixed workflow may be enough. The five parts still help, because they work as a brief for a workflow builder or a colleague too.

Where TobyBot fits

TobyBot is an agentic bot by Xinference. You set a goal. TobyBot plans the steps, shown as one card for each, then runs them with your tools. Every tool call and result is visible while it runs, and you can pause it. A task can be saved as a bot that keeps its role, model, tools and knowledge, and can be run again or scheduled. You can start at the TobyBot home page, or contact us if you have a question about a specific task.

Try TobyBot. See what teams set it to do, or book a demo and bring a goal.