An agent cannot mark work complete
The loop reads open work from task records, does the work, then verifies end to end under the real users’ permissions and deletes the test data. Only then is the task closed, with a note saying what was done and how it was checked. The verification step is the product.