Your First Delegated Job

The founding charter

An agent, in plain terms, is a chat model wired to act: it opens files, fetches pages, runs commands, and loops until it decides it's done. The tools that do this well started as coding tools — Claude Code, OpenAI's Codex (folded into ChatGPT since it began running in a sandbox or on your machine), and OpenClaw, a free, self-hosted alternative. Hosted research agents in ChatGPT and Gemini offer a browser-free fourth option for anyone who'd rather not touch a terminal, and since February 2026 can be told to stay within a named list of sites.

The real subject is delegation itself: writing down what "finished and correct" means before a run, and having a number the agent has to beat. The chapter walks through an invented small coffee roaster's owner handing over one gradeable task — building a supplier comparison table from eight price lists — and timing and grading her own hand-done version first, to get a baseline of speed and error rate to measure the agent against. It covers what to feed an agent (the actual source files, not descriptions of them), the tool and permission settings across the three main platforms (from Claude Code's settings and permissions to Codex's sandbox-plus-approval design and OpenClaw's named modes), and — the core of it — why requiring a source citation for every value is the single rule that catches invented numbers before they reach a decision. It ends by pointing at what still isn't solved: nothing persists between sessions on its own.

What changed lately that touches this

Billing shifted: Anthropic moved automated and headless agent runs off flat subscriptions and onto metered credits through 2026, so a background job now costs differently than a live session. The connector standard that lets an agent pick up a browser or other tool without custom glue code, published by Anthropic, was reworked toward a simpler design in 2026. And screen-clicking "computer use" agents — genuine but unstable, with OpenAI's Operator launched and then discontinued — are worth reaching for only when a supplier gives you no plain page to read instead.

The job you hand over first

Somewhere on your computer there is a task you keep putting off because it is dull and fiddly and nobody else will do it. Comparing five suppliers on price. Checking what four competitors charge. Copying numbers out of a pile of quotes into one place so you can finally decide something. That task is the right place to start, and this chapter is about handing exactly one task like that to an agent and finding out honestly whether it did the job.

First, what an agent is, in plain terms, because the word gets used loosely. A chat assistant answers you. You paste in a question, it writes back words, and nothing in the world changes. An agent is that same kind of model wired up so it can act: it can open files on your machine, fetch a page from the web, run a command, and write a file back out. It works in a loop. It reads its instructions, decides on a step, takes the step, looks at what came back, and decides on the next step. It keeps going until it thinks it has finished. The interesting part is not that it writes nice sentences. It is that it does things, and things it does are things you now have to check.

The tools that do this well today started life as coding tools. Claude Code is one, and it lives in a terminal window on your own computer. OpenAI's Codex is another, and since it was folded into the ChatGPT desktop application in July of two thousand twenty-six it runs either on your machine or in a sandbox in the cloud. OpenClaw is a third, and it is different in kind: it is free, open source, and you run it yourself, on your own laptop or a small rented server, and you talk to it through a chat app or a little web dashboard. All three were built with programmers in mind. All three will read a folder of price lists and write you a comparison, because reading files, fetching pages and writing files is the same work whether the files hold code or supplier quotes.

There is a fourth option, and if you have never opened a terminal in your life it may be where you begin. The hosted research agents inside ChatGPT and inside Gemini let you drag documents into a chat box and set a task loose on the web. They run entirely on the vendor's machines. They cannot touch a single file on your computer, which is both their limitation and their safety. Since February of two thousand twenty-six you can also tell them to stay within a list of websites you name.

That is the landscape. Now the thing this chapter is actually about, and it is not any of those products.

Delegation is not typing a request. Delegation is writing down what finished and correct means before anything runs, and having a number the machine has to beat. An agent that answers confidently and wrongly costs you more than doing the task by hand, because you paid for the run, you paid for the review, and then you paid again for whatever the wrong answer led you to do. The only defence is a check you wrote first. Everything below is that idea, taken slowly.

I am going to use an invented business all the way through, and I want to be plain that it is invented. Bell Lane Coffee does not exist. It is a small roaster that sells bags of coffee to about thirty cafes. Every number I attach to it is made up too: the prices, the times, the error counts. I am inventing them so the shape of the work is visible. Your real numbers will differ, and your real numbers are the only ones that count.

Bell Lane's owner has a folder with eight price lists in it, from eight green coffee importers, collected over the past few months. Some are spreadsheets. Some are PDFs. Two are just emails with the numbers in the body. She wants one table: for each importer, the price per kilo of a washed Ethiopian, the minimum order quantity, and the lead time in days. Twenty-four cells of information. She has been meaning to do it since spring.

That is a good first job, and it is worth saying exactly why, because the reason generalises.

It is small enough to check in one sitting. Eight rows. She can verify every one of them in twenty minutes if she has to.

It has a right answer that already exists somewhere. Each number is written down in a document she has. There is a source she can point at. Nothing has to be judged, estimated or predicted.

And it is boring enough that she already resents doing it. That matters more than it sounds. If a task is interesting you will do it yourself and enjoy it. The tasks worth delegating are the ones you avoid, because avoiding them is already costing you.

Now three tempting first jobs that will teach you nothing, and what is wrong with each.

The first: ask the agent which importer Bell Lane should buy from. It will answer. It will answer well, in confident paragraphs, weighing price against reliability against ethics. And you cannot grade it. There is no right answer sitting in a document. If it is wrong you will not find out for six months, when the coffee is late. A first job has to be gradeable, and gradeable means you can say yes or no about each part of it without arguing.

The second: ask it to compare what those eight importers charged this time last year. The sources do not exist. Bell Lane never kept last year's lists. The agent will not tell you the sources do not exist. It will produce a table, because a table is what you asked for, and the numbers in it will be plausible and hollow. Never start with a job whose evidence you cannot put your hands on.

The third: ask it to draft and send a reply to the cafe that complained about last week's delivery. Here a wrong answer reaches a real customer. Money and goodwill are on the far side of the mistake. You want your first errors to happen where the only cost is your own time.

The three numbers you write down before you start

Here is the step nearly everyone skips, and skipping it is how a bad automation survives in a business for months. Before the agent runs, do a slice of the work yourself, with a stopwatch, and count your mistakes.

Bell Lane's owner takes three of the eight importers. Not all eight. Three is enough to measure and does not eat the afternoon. She starts a timer, opens the first price list, and fills in the three cells: price per kilo, minimum order, lead time. Then the second. Then the third. She stops the timer. Fourteen minutes for three rows, which puts the full eight at somewhere around thirty-seven minutes.

Then she does something slightly odd. She checks her own three rows against the sources a second time, carefully. She finds one wrong. She had read a price as being per kilo when the list quoted it per pound, and the number she wrote down was too low by a bit under half. One error in nine cells.

So she has three numbers. About thirty-seven minutes for the full job. Her own time, which for a business owner is the only money the job costs at this scale. And an error rate of roughly one cell in nine, on work she was concentrating on.

The minutes get quoted most often and matter least. The error count is the one that protects you. Think about what happens without it. Six months from now the agent is doing this job every month and doing it in ninety seconds, and everyone is delighted, and nobody knows whether the numbers are right, because nobody ever established what right looked like or how often a human gets it wrong. The comparison you need is not agent against perfection. It is agent against you on a normal Tuesday. If you got one cell in nine wrong, an agent that gets one in nine wrong has matched you, and an agent that gets one in three wrong has failed, and without your own figure you cannot tell those apart. That is why the honest, slightly embarrassing count of your own mistakes is the most useful thing you will write down today.

Keep those three numbers. They are the baseline, and every later version of this job gets measured against them.

Now the handoff. There are four things an agent needs, and the order matters, so take them one at a time.

The first is the material. Not a description of the material. The material. This is the mistake that ruins more first attempts than any other: people write a careful paragraph about their supplier documents and never give the agent the documents. Bell Lane's owner puts all eight files into one folder and points the agent at that folder. If two of the prices only exist on a supplier's public web page, she gives the actual web addresses, not the supplier's name. An agent that cannot reach a source will not usually stop and say so. It will proceed with what it has, which is your description, and a description of a price list is not a price list.

The second is the tools. What may it read, what may it write, what may it fetch. All three of the local tools read and edit files on your machine and run commands in a terminal. All three can fetch a public web page. None of them, out of the box, drives a real graphical browser the way you do with a mouse, so a supplier price list buried inside a complicated web application is a job you have to add a piece for. With Claude Code you attach a browser connector through the Model Context Protocol, which is the open standard Anthropic published at the end of November two thousand twenty-four for plugging outside tools into a model, and which the other big labs adopted afterwards. With Codex you enable its browser or computer-use plugin. With OpenClaw you install a browser or search skill. The general point: fetching plain text from a public page is built in everywhere, and rendering a page like a human does is an extra you must deliberately add.

The third is the permissions. What may it do without asking, and what must it stop and ask you about. Every one of these tools has a version of this control, and they are worth knowing by shape rather than by exact wording, because the wording changes.

Claude Code keeps its rules in settings files, one for you and one for the project you are working in. In its manual mode, reading things inside the folder you are working in happens without a prompt, while changing a file, running a shell command or reaching out to the web stops and asks. Early in two thousand twenty-six it added an automatic mode that uses a small classifier model to wave through the safe commands and only interrupts you for risky ones. You can also switch the guardrails off entirely with a flag, and the reason to know that exists is so you never do it on your first job.

Codex works in two layers, which is a genuinely different design. Underneath, the operating system itself boxes it in, using Apple's sandbox machinery on a Mac or a restricted write token on Windows, so it physically cannot change files outside the workspace you gave it. On top of that sits an approval policy deciding whether stepping outside the box, running a command or opening a network connection needs your click.

OpenClaw names its modes plainly: deny, allowlist, ask, auto, and full. In ask mode, anything that would change a file or run a command messages you in whatever chat app you have hooked up and waits. Full mode hands your machine over without conditions, and since OpenClaw is something you host yourself, on a machine whose file permissions you configured, full is the setting that turns a bad web page into a bad day.

For a first job, ask mode, or the manual equivalent, is right. It is slower. Being interrupted teaches you what the agent is actually trying to do, which is exactly what you are here to learn.

The fourth thing is the acceptance criteria, and this is where the chapter's argument lives. Acceptance criteria are plain sentences describing the finished work, written before the run, specific enough that a person could hold the output beside them and mark each one yes or no.

Bell Lane's owner writes four. The output is a single comma-separated file with one row per importer and exactly four columns: importer name, price per kilo in pounds sterling, minimum order in kilos, lead time in days. Every price is per kilo, converted if the source quotes per pound, and the conversion is stated. Every row carries a reference to where its numbers came from: the file name, or the web address, and the page or line. And if a value cannot be found in the material provided, the cell says not found, and the agent does not supply a figure from anywhere else.

Read that third one again, because it is the one doing the heavy lifting. One source reference per row. It costs the agent almost nothing to produce and it changes what you are able to see.

Why does it matter so much? This is worth understanding from the ground up rather than taking on trust, because it explains most agent failures you will ever meet.

A language model produces likely text. That is the whole of the mechanism. It has read an enormous amount of writing, and from that it has learned, extremely well, what tends to come next. Give it the beginning of a sentence and it continues in the way such sentences usually continue. Now think about what that means when it is halfway through building your table and it reaches the cell for the fifth importer's lead time, and that number is not in any document you gave it. The cell wants filling. Lead times in coffee importing are usually somewhere between two and six weeks. Fourteen days is an extremely likely thing to appear in that position. So fourteen days appears.

Nothing has gone wrong inside the machine. It was not lying, and it was not confused about what a lead time is. It was doing the only thing it does, which is producing likely text, in a spot where you never made looking at the record part of the job. A model does not consult a source unless consulting the source is a step in the work you asked for. That is the whole insight, and once you have it, the fix is obvious: make the source part of the output. If every row has to carry the reference it came from, then inventing a number means inventing a reference too, and an invented reference is something you can check in seconds.

So she runs it. She points her agent at the folder, gives it the two web addresses, sets it to ask before writing anything, and writes her four criteria straight into the prompt. All three of these tools also let you park standing instructions in a file in the project so you do not retype them. Claude Code reads a project instruction file. Codex reads a file that describes the agent's rules for that workspace. OpenClaw keeps two, one for how it should behave in general and one for what it is allowed to do here. The exact file names differ and they have changed before, so read the current documentation for whichever tool you picked rather than trusting my memory of a name; the point that holds is that written standing instructions are supported in all three.

Two minutes later she has a table. Eight rows, every cell filled, columns exactly as asked, tidy. It looks finished. This is the moment that catches people, so slow down here.

She reads the source references. Seven of them point at real files with plausible page numbers. The eighth, for an importer called Harbour Green, gives a price of nine pounds twenty a kilo and a reference that says, roughly, from the importer's published price list. Not a file in the folder. Not one of the two addresses she supplied. A description of a document that would exist if the world were tidy.

She opens the folder. Harbour Green's file is an email, and the email quotes a price for a Colombian, not the Ethiopian she asked about. The number she needed was never there. Nine pounds twenty is a completely sensible price for washed Ethiopian green coffee, which is precisely why it appeared.

Without the source rule that error is invisible. It is one plausible number in a tidy table, and she would have carried it into a purchasing decision. With the source rule it took her about two seconds, because a vague reference stands out against seven precise ones the way a blank stands out in a form.

Now the important move, and it is not the obvious one. The obvious move is to fix the cell. Type not found over the nine pounds twenty and get on with the day. Do that and you have done the job by hand, slowly, with extra steps, and next month the same thing happens again.

Repair the workflow instead. Her criterion said an unfound value should be returned as not found. The agent filled it in anyway, which tells her the instruction was not forceful enough or was not phrased as a rule about behaviour. So she rewrites it. Every reference must name a file that exists in the folder or one of the addresses given, and nothing else counts as a source. If a value cannot be found in one of those, the cell reads not found and no figure is written. She adds a line saying not found is an acceptable and expected result, because otherwise the pull toward a complete-looking table is very strong.

She re-runs. Two minutes. Seven rows with precise references. Harbour Green's lead time and price now read not found. She spot-checks three of the seven against the original documents and they are right.

Compare that against the baseline, on all three numbers. Time: the agent took about two minutes of its own, twice, plus roughly twenty-five minutes of her time reading criteria, reading the output, hunting the bad row and rewriting the rule. Call it half an hour against thirty-seven minutes by hand. Money: she was on a Claude Pro subscription at twenty dollars a month, where small jobs come out of a shared monthly allowance and are effectively already paid for. Had she been billing per token instead, a job this size on a mid-range model runs somewhere in the region of thirty to eighty cents, and the same job through OpenClaw on a cheaper model can land nearer five to fifty cents, since the software is free and you are only paying whichever model provider you plugged into it. Accuracy: one invented cell caught, seven rows sourced, one honest gap where a gap really exists. Her own hand pass had one wrong cell in nine and she had not known.

So on time it roughly tied. On the first run, honestly, it probably lost. And it still won, for a reason that has nothing to do with this month. What she has now is not a table. It is a written instruction that produces the table, and it will run again in two minutes when the ninth importer sends a list in January. Her hand pass produced a table and nothing else. It was never reusable. It never could be. That is the real return, and it is why a first run that loses on the stopwatch is not a failure.

One thing that is deliberately not solved yet, and I want to name it plainly rather than let you discover it as a disappointment. Nothing in what she did survives between runs on its own. Close the session and the agent remembers none of it. The criteria live in her prompt or in a file she has to remember to point it at. Next month she will retype or re-find them, and the version she retypes will be slightly worse, because the careful phrasing about what counts as a source will be the part she abbreviates. Turning a session that worked into written instructions the agent picks up every time, without you carrying them in your head, is the next thing to build.

What changed lately that touches this

A few developments from the past couple of years change how you would set that job up, and one of them changes what it costs.

The money one first, because it can surprise you. Through two thousand twenty-six the providers stopped letting flat monthly subscriptions pay for automated agent work. On the fourth of April two thousand twenty-six Anthropic stopped Claude Pro and Max subscriptions from powering third-party agent harnesses, OpenClaw among them, and moved that traffic to metered billing. On the fifteenth of June it moved headless runs of its Agent software development kit out of the subscription pool onto metered credits as well. Sitting in an interactive session, as Bell Lane's owner did, is still covered by the subscription. Running things in the background on a schedule is now metered. Operators doing continuous automation saw their bills rise steeply, in some accounts by a large multiple. The practical action is to check today which side of that line your setup falls on before you automate anything on a timer, and to put a spending cap on the account either way. The tradeoff is real but it is not a reason to avoid the tools; it is a reason to know what a run costs before you make it hourly.

The connector standard is the second. That protocol Anthropic opened up at the end of two thousand twenty-four is how you bolt a browser, a payments system or a notes tool onto an agent without writing glue code yourself, and its specification was reworked in the summer of two thousand twenty-six toward a simpler request-and-response design. For you that means fewer bespoke integrations to maintain. The tradeoff is exposure: a connector that reaches your internal systems has handed an agent a door, so authentication and a gateway you control stop being optional the moment the connector touches anything that matters.

The third is browser and computer control, the ability of a model to look at a screenshot and click. Anthropic shipped that with a Sonnet model in October two thousand twenty-four, and Google followed with a Gemini computer-use model in October two thousand twenty-five. OpenAI launched Operator in January two thousand twenty-five for its two-hundred-dollar tier, which scored around fifty-eight percent on a standard web-task benchmark, then replaced it, and its replacement was itself pulled in August two thousand twenty-six. Read that sequence as the warning it is: this capability is genuine and the products carrying it are not stable. Use it only where a supplier gives you no plain page and no interface to call. It burns tokens on every screenshot, it stumbles when a layout shifts, and pointing it at somebody else's web page means text you did not write is arriving inside your agent's instructions.

Which is where I will leave you, with one job to try and one rule to carry into it. Pick something small, boring, and already answered in a document you have. Write down what finished and correct means. Time yourself doing three rows and count how many you got wrong. Then hand it over.