The Beginner AI Agent Setup Checklist

What does a first agent setup actually need?

Six things, in this order. A host you can install and remove. A workspace with a boundary you can point at. A written list of actions the agent may never take alone. A spend ceiling. Three workflows that end in an inspectable draft. A habit of reading that draft. Everything past those six is optimization.

• One host, on one machine you control
• One workspace directory, credential files denied by rule
• A deny list written before the first prompt
• A spend ceiling that starts at zero
• Three workflows that produce a draft, not an action
• A review step before anything leaves your machine

Which host should you install first?

Monolith runs Claude Code and Hermes daily and compares OpenClaw as a third harness. Pick one and stay there for the first month. Two hosts before you understand either gives you two half-configured environments and no reliable answer to which one wrote a given file.

The choice depends on where the work lives, not on feature lists. If the work is a code repository, Claude Code already sits in it. If the work is operations, research, and recurring reports spread across many folders, a general operator fits better. Install one, run real work through it, then decide whether a second earns its cost.

How do you bound the workspace before the first run?

Give the agent one directory. Project files inside it, credential files outside it, and deny rules that make the boundary real rather than aspirational. In Claude Code the permission block lives in a settings file, and those rules are enforced by the harness, not by the model. That distinction carries the setup: a memory file shapes what the agent tries, while deny rules decide what it is permitted to do.

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./**/secrets/**)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(rm *)",
      "Bash(curl *)"
    ],
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)"
    ]
  }
}

Three properties are worth memorizing. Deny beats allow, so a deny rule cannot be talked out of the way by a persuasive prompt. Allow rules in a shared project file wait for the workspace trust dialog, while deny and ask rules take effect immediately, which is the asymmetry you want. And a key set in several files resolves by precedence, managed organization settings on top, your personal file at the bottom.

Then verify instead of assuming. Read every loaded rule back, and the file each came from, before the agent gets a real task. A rule you believe you wrote and a rule the harness loaded are two different objects, and the gap between them is where beginner setups break.

# Where skills and settings live on disk
ls ~/.claude/skills              # personal skills, every project
ls .claude/skills                # project skills, this repo only
cat .claude/settings.json        # shared, committed to the repo
cat .claude/settings.local.json  # personal, kept out of git
ls ~/.hermes/skills              # the Hermes skills directory

# Inside a running session
/permissions   # every rule, and the file it came from
/status        # which settings sources actually loaded
/usage         # session cost and what consumed it
/context       # what is filling the context window

Which actions stay behind a human?

Reading needs no gate. Drafting into a file you can open needs no gate. Anything with a consequence outside your machine does. Write that list while nothing is on fire, because the moment you need it is the moment you are tempted to skip it.

What should the first month cost?

Start at zero. Use the subscription and models you already pay for, install no billable key, and let the first month show what the work demands. When a paid key earns its place, add it with a ceiling and a scheduled review, not as an open-ended credential.

Two habits do most of the cost work. Clear the session between unrelated tasks, because every request carries the whole conversation and stale context is billed on every turn. And match the model to the job instead of leaving the largest one as the default. The same documentation puts agent teams, which run several instances at once, at roughly seven times the tokens of a single session.

Which three workflows go first?

Pick three that end in something you can read. A research brief with sources. A recurring status summary built from files you already keep. One task specific to your role: a proposal outline, a delivery check, a lead sheet. For each, write the trigger, inputs, output file, and acceptance check before the first run.

Do not schedule anything until a workflow has produced the same acceptable result twice from the same inputs. A scheduled task fires whether or not it is still correct, it sends your full context every run, and an unattended job is where a missing gate does damage before anyone notices.