An agent running with no one watching — in CI, on a schedule, or triggered by an event — with its output reviewed after the fact.
Headless runs are where agents stop being a typing accelerant and start being infrastructure: nightly triage, scheduled maintenance, a job that opens a pull request when something drifts. Nobody is present to catch a wrong turn mid-run.
That absence sets the requirements. Scope the credentials to the minimum, make the output a proposal rather than a deployment, and write enough of a trace that you can reconstruct what it did. A headless agent that pushes directly to production is a scheduled incident.