proactive-agent-behaviors v1.0.0

name: proactive-agent-behaviors description: Move an AI agent from task-follower to proactive partner. Use when designing anticipation behaviors, working buffers, idle-time routines, autonomous checks, notification policies, or when deciding when the agent should act vs ask. Harness-agnostic, permission-safe defaults throughout.

Proactive Agent Behaviors

Purpose

A task-following agent answers what it is asked. A proactive agent notices what needs doing, prepares before being asked, and intervenes only when the value outweighs the interruption. This skill gives you the patterns to build that behavior safely: a permission ladder that decides act vs ask, trigger patterns that work in any harness, and guardrails that keep proactivity from turning into noise or damage.

Workflow

1. Set the permission ladder. Before the agent does anything proactive, write its act-vs-ask ladder and make it explicit:

• Act freely: low-risk, reversible, private, bounded. Read-only analysis, drafts, summaries, organizing existing data, local-only preparation.
• Act, then report: low-risk actions with mild external effect. Drafting an email (not sending), updating non-sensitive docs, filing internal notes.
• Ask first: external, irreversible, expensive, privileged, bulk, legally sensitive, or socially visible actions. Sending messages, spending money, changing production data, deleting anything, posting publicly.
• Never: actions the agent cannot undo or cannot verify. Never let the agent grant itself more power, and never rely on the model to "be careful" instead of enforcing permissions in the application layer.

1. Calibrate trust over time. Start new deployments at ask-first for consequential actions. Promote specific action classes to act-then-report only after a track record of correct behavior on real work (30+ days of reliable evidence is a reasonable bar). On any incident, regress that action class one level down immediately, investigate, then re-earn.

1. Pick trigger patterns from references/trigger-patterns.md that match what the agent needs to do. Each pattern pairs a trigger (schedule, watch, event, idle) with a notification policy and a permission check.

1. Set a notification budget. Proactivity fails when it becomes nagging. Cap unprompted messages: batch low-priority findings into digests, use quiet logging for information-only results, reserve immediate alerts for time-sensitive risk. "Notify me" is not the same as "ask me", and neither is a daily interrupt.

1. Run the working-buffer pattern. Give the agent a standing instruction to spend idle time on the highest-value prep work: pre-fetching context for likely requests, precomputing summaries, keeping watch state current. Cheap local filtering first, expensive reasoning only when the evidence crosses a threshold.

1. Log everything. Every proactive action writes an audit line: what triggered it, which permission level applied, what it did, and what the outcome was. Humans review exceptions and aggregates, not every decision.

Output Contract

• A written permission ladder for the agent: four lists (act freely / act-then-report / ask first / never) with the specific actions in each class for this deployment.
• A trigger catalog: each proactive behavior names its trigger, its schedule or event source, its notification policy (alert / digest / log), and its permission class.
• A trust-calibration plan: current level per action class, what evidence promotes it, what incident regresses it.
• An audit format: trigger, permission class, action, outcome, timestamp.

Operating Rules

1. Authority design beats prompt engineering. Write the ladder into configuration the runtime enforces, not just into the system prompt.
2. Default to ask for anything external, irreversible, expensive, or socially visible. Default to act for private, reversible, bounded work.
3. Reads are not automatically safe. Guard secrets, PII, and anything the agent could leak into a draft.
4. Idle time is for preparation, not action. The agent pre-computes and pre-fetches while idle; it acts when a trigger fires and permission allows.
5. Keep the risk ladder narrow: observe, analyze, propose, draft, execute, publish. Skip steps only where the permission class already covers the jump.
6. Trust is earned in increments, never granted up front. More autonomy means sharper human oversight of exactly when to step in, not less attention overall.
7. If a proactive behavior misfires, fix the trigger and the permission class, not just the prompt. The pattern that allowed the misfire is the bug.