What the mainframe already taught us about AI agents

Every week someone shows me a new AI agent that books flights, refactors code or reconciles invoices on its own. And every week I think about batch jobs.

For decades, the systems that run banks and airlines have executed millions of unattended jobs every night. Nobody watches them run. What makes that safe isn't intelligence, it's discipline:

• Every step is restartable. If step 7 of 12 fails, you fix it and restart at step 7. You don't redo the whole night.
• Every action leaves a trail. When something goes wrong at 3 a.m., the logs tell you exactly what ran, with which input, and what it changed.
• Side effects are explicit. A job declares up front what it reads and what it writes. Nothing touches data it didn't ask for.

Most agents today have none of this. They improvise a plan, call tools, and if something breaks halfway you often can't tell what already happened.

What I'd ask of any agent before trusting it

1. Make steps idempotent. Running the same step twice should be harmless.
2. Checkpoint state outside the model. The plan and its progress should live somewhere durable, not only in the context window.
3. Declare permissions narrowly. Read access by default. Writes only where the task needs them.
4. Log decisions, not just actions. "Why did you do that?" should have an answer on record.

None of this is new. The models are new. The engineering that makes automation trustworthy has been around for half a century, and we should borrow it shamelessly.