Step 1: choose one job with a definition of done
Begin with a sentence that names the user, trigger, deliverable, and reviewer. For example: “When an account executive enters a company and opportunity context, produce a sourced account brief for review before the discovery call.” That is more actionable than “help with sales” because it establishes when the assistant starts and what completion means.
Keep adjacent tasks out of version one. Researching an account, drafting outreach, updating a CRM, and sending an email have different evidence and permission requirements. Prove one outcome, then decide whether to add a controlled handoff to the next specialist or tool.
- Named user and business moment.
- One primary artifact or workspace outcome.
- Required inputs and optional context.
- Reviewer and measurable acceptance criteria.
- Explicit exclusions for version one.
Step 2: write instructions as an operating contract
Organize instructions in a stable sequence: role, objective, source boundary, method, output contract, uncertainty behavior, escalation, and prohibitions. Use direct language and observable requirements. “Cite every material market claim” is testable. “Be accurate” is an aspiration. “Never infer private company metrics” defines a useful boundary.
Avoid hiding essential business rules inside examples or personality prose. OpenAI recommends clear instructions and well-defined tools as agent foundations. Anthropic similarly emphasizes simple, composable patterns and careful tool interfaces. The assistant should understand which instruction wins when speed, completeness, and evidence conflict.[1] [2]
Evidence rule
State which claims need citations, which sources are allowed, and how to label supplied facts versus assumptions.
Output contract
Define headings, fields, tables, length, tone, and a completion checklist.
Escalation rule
Name missing inputs, low-confidence conditions, conflicts, and actions that require human judgment.
Step 3: scope context and capabilities
Context should be relevant, current, and authorized. Give the assistant the minimum company facts, reference documents, and connector scope required for its job. More context is not automatically better: stale policies and unrelated files can create conflict, increase cost, and make source attribution harder.
Classify tools by effect. Web search and read-only connectors gather information. Code can calculate or transform. Canvas can create an artifact. A connector write can alter an external system. OWASP recommends least privilege and explicit approval for security-relevant changes; the same principle is useful across operational business tools.[6] [11] [10]
- Every attached source has an owner and review date.
- Connector access is limited to necessary accounts and data classes.
- Read access is separated from create, update, send, publish, and delete.
- External content is treated as evidence, not as new system instructions.
- High-impact actions pause with a clear preview of the proposed change.
Step 4: build the evaluation set before launch
An evaluation case contains an input, environment, and success criteria. Start with ten to twenty representative cases: common work, incomplete information, conflicting sources, an out-of-scope request, a tool failure, and a request for a prohibited action. Run more than one trial for cases where model variability matters.
Grade both the final outcome and the trajectory. Deterministic checks can confirm required sections, calculations, links, and prohibited tool calls. A rubric can assess usefulness and judgment. Human reviewers calibrate the rubric and examine sensitive edge cases. This mixed approach follows current agent-evaluation guidance.[3]
Capability cases
Hard tasks that show where the assistant can improve.
Regression cases
Known-good behaviors that should keep passing after changes.
Safety cases
Requests that test data boundaries, prompt injection, excess agency, and escalation.
Weak setup vs production-ready setup
The difference is operational specificity. Both may look good in one demo, but only one can be reviewed and improved.
| Design area | Weak setup | Production-ready setup |
|---|---|---|
| Role | “You are a helpful marketing expert” | Named user, trigger, deliverable, method, and exclusions |
| Sources | Use any information available | Approved source classes, freshness rules, and claim-level citations |
| Tools | Enable everything in case it helps | Minimum capabilities with action tiers and approvals |
| Quality | Looks convincing in a demo | Passes repeated outcome, trajectory, regression, and safety cases |
| Change | Edit the live prompt | Create a version, run evals, release, monitor, and roll back |
The 60-minute custom assistant workshop
Use the hour to produce a testable version-one configuration, not a complete automation program.
- 01
Frame the job
Outcome: A one-sentence job, explicit exclusions, and an accepted example.
- Interview the person who reviews the current work.
- Choose one output and one business moment.
- 02
Draft the contract
Outcome: Structured instructions with evidence and escalation rules.
- Write required steps in the order they should occur.
- Define what the assistant must say when information is missing.
- 03
Choose capabilities
Outcome: A minimal tool and context set.
- Begin with read-only access and artifact creation.
- Document why every enabled capability is necessary.
- 04
Create five launch cases
Outcome: A compact normal, ambiguous, failure, and safety suite.
- Specify pass conditions before running the assistant.
- Include at least one case that should escalate.
- 05
Run, revise, and version
Outcome: A known-good configuration ready for a monitored pilot.
- Fix the smallest root cause behind each failure.
- Save the passing version and assign a human owner.
Prompts you can use
Replace the bracketed details, attach the relevant source material, and keep the review step in the same workspace.
Operating contract
Prompt 01Turn this job description into a custom assistant contract with these headings: user and trigger, objective, accepted inputs, required method, evidence rules, output schema, allowed tools, prohibited actions, uncertainty behavior, escalation conditions, and definition of done.
Why it works: It produces a structured configuration that can be evaluated section by section.
Evaluation builder
Prompt 02Create twelve evaluation cases for this assistant: four normal, two ambiguous, two conflicting-source, one out-of-scope, one tool-failure, and two safety cases. Define deterministic checks, rubric criteria, and the expected escalation behavior for each.
Why it works: It creates coverage before a successful demo creates false confidence.
Version review
Prompt 03Compare the proposed assistant version with the current known-good version. Identify changed instructions, context, tools, permissions, and expected behavior; select the regression cases that must run; and provide a release and rollback note.
Why it works: It treats configuration changes with the same discipline as product changes.
Editorial method
How this guide was prepared
This setup guide translates current agent-design, least-privilege, and evaluation guidance into a practical assistant configuration workflow. Kona-specific claims were checked against custom assistant creation, capability controls, version history, sharing, publishing, forking, chat invocation, and Workspace use on August 11, 2026.
Read Kona’s editorial standardsSources
Sources and benchmarks
01
02
Building effective agentsAnthropic · 2024-12-19
03
Demystifying evals for AI agentsAnthropic · 2026-01-09
04
Trustworthy agents in practiceAnthropic
05
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileNational Institute of Standards and Technology · 2024-07-26
06
Agentic AI threats and mitigationsOWASP GenAI Security Project
07
Creating helpful, reliable, people-first contentGoogle Search Central
08
Configurable AI assistants for business workKona Business AI
09
AI business planning workspaceKona Business AI
10
AI data governance and metric opsKona Business AI
11
Data connectors and analytics platformKona Business AI