Autonomous Agent Routines: Cron Workflows That Run Without You

Everything so far assumed a human in the loop — you typed the prompt, you watched it run. The endgame is an agent that runs without you: a nightly routine that triages new issues, sweeps dependencies for CVEs, or drafts a standup from yesterday's commits, on a cron, while you sleep. That is also where the danger lives. An unattended agent with a bug, a runaway loop, or an injected instruction (Lesson 10) has no human to hit stop. The final discipline is making autonomy safe.

Core Architectural Concepts & Trade-offs

An autonomous routine is the whole series composed into one scheduled process: a cron trigger fires a checkpointed agent loop (Lesson 12), bounded by guardrails (Lesson 10), gated by evals (Lesson 14), running against governed tools (Lesson 13). The shift from interactive to autonomous removes the human safety valve, so everything that was a nice- to-have becomes mandatory. The question for every design choice is no longer "is this convenient?" but "what happens at 3am when this misbehaves and nobody is watching?"

Three controls are non-negotiable. A budget cap — a hard token and dollar ceiling that aborts the run, not a soft target — because an unattended loop with no ceiling is an unbounded bill. A kill switch — an external flag the routine checks each iteration, so you can stop a misbehaving agent without a deploy. And idempotency across runs — if last night's routine half-finished, tonight's must not double-process, the same exactly-once discipline from Lesson 12 applied at the schedule level. None of these matter much with a human watching; all of them are load-bearing without one.

Observability replaces the human you removed. With nobody watching the run, the run has to report itself: structured logs of every decision and tool call, the token spend, and a summary delivered to a channel you actually read. A routine that silently succeeds and silently fails is indistinguishable from one that isn't running at all — and the failure mode you fear most is the one that fails quietly for a week. Make success and failure both loud.

The trade-off is autonomy versus blast radius, and it sets the altitude of the work you delegate. Scope unattended routines to bounded, reversible, low-stakes tasks — drafting, triaging, summarizing, opening a PR for review — and keep a human gate on anything that ships to production, moves money, or contacts a customer. The mature pattern is autonomy that prepares and a human that approves: the agent does the tireless overnight work and stops at the boundary where judgment and accountability still belong to a person.

A Scheduled Autonomous Routine

A cron-triggered routine with a hard budget cap, an external kill switch checked each iteration, run-level idempotency, and a delivered report.

// Unattended autonomy. Every control here is load-bearing without a human.
export async function nightlyTriage(runId: string) {
  // Run-level idempotency: never re-run a completed night.
  if (await store.get(`done:${runId}`)) return

  const BUDGET = 200_000           // hard token ceiling — aborts, not warns
  let spent = 0
  const log: Decision[] = []

  for (const issue of await fetchNewIssues()) {
    // Kill switch: an external flag you can flip without a deploy.
    if (await flags.get("triage.kill")) { await report(log, "KILLED"); return }
    if (spent >= BUDGET)             { await report(log, "BUDGET_EXCEEDED"); return }

    const res = await classify(issue.body)         // eval-gated prompt (L14)
    spent += res.usage.tokens

    // Bounded + reversible only: label and comment. No closing, no shipping.
    await gateway.call("github__label", { id: issue.id, label: res.label })
    log.push({ issue: issue.id, label: res.label, tokens: res.usage.tokens })
  }

  await store.put(`done:${runId}`, true)          // idempotency marker
  await report(log, "OK")                          // loud success AND failure
}

// Scheduler — fires the routine; the routine governs itself.
export const schedule = { cron: "0 3 * * *", handler: nightlyTriage }

The budget aborts a runaway, the kill flag stops it mid-run without a deploy, the done marker prevents a double-run, and the report fires whether the night succeeded or failed. The agent works while you sleep — inside a box you can prove the edges of.

Autonomy Inside a Box

That closes the roadmap: from a single token in a context window to an autonomous routine that works overnight inside a box you can prove the edges of. Revisit any stage from the full roadmap, or start a conversation about shipping this into your own stack.