It's not safe or reliable, no matter how hard you try. Fundamentally, agents will try whatever they can to achieve the goal, as we've seen in many recent security incidents.

If determinism is important, as it is in many business use cases, use agents to build the tool, but don't let them run it.

I built a similar product around this exact idea: AI builds the workflow. Fixed rules run it.