The guardrails I put around every AI agent I run
# The guardrails I put around every AI agent I run
Most agent demos show the same half of the story. A model plans a task, clicks through it, sends the messages, and finishes with nobody touching the keyboard. The clip ends on the result. The fence around the whole thing never makes it into the frame.
I run a handful of agents against my own infrastructure. They touch real files and real accounts, and one of them can spend money. None of them roams free, and after enough time living with these systems I have come to believe the fence is where nearly all of the safety lives. The walls are boring to build and boring to describe. I want to describe them anyway, because they decide whether you end up with a useful assistant or a slow accident.
What an agent is once the hype is stripped off
An agent is a loop. The model reads a goal, picks an action from a list of tools you handed it, runs the action, looks at what came back, and decides what to do next. It repeats that until it believes the job is done.
The loop is genuinely powerful, and the power is the problem, because the tools are real. Give an agent a tool that sends email and it can actually send email. Give it a tool that deletes files and files can actually disappear. Each of those choices is made by the model, on its own reasoning, which is usually sound and occasionally very wrong.
The dangerous ingredient is confidence
Nobody needs to worry about a malicious agent. The thing to worry about is an agent that is wrong and certain at the same time. It will misread one line, pick the wrong file, or address the wrong person, and it will do so with complete conviction that it is executing the plan correctly.
The failures are rarely cinematic. They are small, dull misunderstandings that would be harmless in a chat window and are expensive the moment a real tool is attached. Worse, there is no wobble in the output to warn you. A model sounds exactly as sure when it is wrong as when it is right, so you cannot wait for hesitation that will never come.
Every guardrail below exists for one reason: to place something deliberate between the model's certainty and anything it could actually break. The doubt has to live in the structure, because the model will never supply it at the right moment.
Least privilege, enforced by a stomach test
The first rule is the simplest and it does the most work. An agent gets the tools its job requires and nothing beyond that. If its job is reading my calendar and summarizing the week, it gets a calendar reader. It cannot message anyone. It cannot touch a file. It cannot spend a cent, because the ability was never handed over in the first place.
The temptation runs the other way. You always want to give the agent a little more, just in case it turns out to need it. Resist that. Every extra tool is another decision the model can get wrong, and the size of the worst case is set entirely by what the agent can reach.
Before any agent runs, I ask one question. If this thing lost its mind right now and did the most destructive thing its tools allow, how bad would that be? When the answer is a slightly wrong summary, it runs. When the answer makes my stomach drop, the agent has too many tools and some get taken away. That single question has prevented more grief than any clever piece of code I have written.
Reading and changing are different animals
There is a bright line between an agent that can look at things and an agent that can alter things, and I treat the two sides completely differently.
A read only agent is close to harmless. The worst it can do is misunderstand something and tell me a wrong answer, which I will catch when I read it. So my read only agents run freely, unattended, all day.
An agent that can send, delete, publish, or pay is another matter, because its mistakes leave the building and become facts in the world. Everything on that side of the line gets the heavier machinery described below. Drawing this one line clearly organizes almost every other decision about how these systems stay safe.
A person in front of anything hard to undo
When an agent genuinely needs to take a risky action, it does not simply take it. It stops, shows me exactly what it intends to do, and waits for a yes. Messages to real people, deletions, spending: all of it pauses at a checkpoint with a human on the other side.
People hear that and assume it defeats the purpose, since the appeal was autonomy. Watch how it plays out in practice, though. The agent does the gathering, the thinking, and the preparation on its own, in seconds, then hands me one clean decision. Send this, yes or no? The machine did the labor and left me only the judgment, which is precisely the trade I want. The checkpoint sits on the handful of steps that could hurt, and everything else flows.
Rehearsal before reality
Before a new agent touches anything live, it rehearses. I run it in a practice mode where every action is faked. It believes it sent the email; nothing left. It believes it deleted the file; the file is untouched. I sit and watch what it would have done.
The first time I did this, I expected a clean run I could flip straight to live. Instead I watched the agent cheerfully prepare several actions I had never intended, in an order that made no sense, because it had read my instructions in a way I did not anticipate. Nothing happened, because nothing was real. Had I skipped the rehearsal, those actions would have gone out into the world. I have never skipped one since. It costs a minute and it keeps catching misunderstandings before they cost anything.
Alongside the dry run, agents operate inside a sandbox, a walled off copy of the things they work on, so even a live action lands on a contained version of the world. The rehearsal finds the dumb mistakes. The sandbox makes sure a clever mistake stays inside a box I control.
Ceilings on money and on speed
Two limits have saved me real pain. The first is a hard cap on anything that costs money, set well below the level that would hurt. If an agent talks itself into a loop of a thousand requests, it hits the wall, stops, and I get an alert instead of a bill.
The second is a cap on how fast an agent may act at all. A healthy agent does a few things and pauses. An agent in a bad loop hammers the same action over and over, very fast. The rate cap throttles that pattern and raises an alarm, and I go look. Neither limit makes the agent smarter. They make sure that when it does something dumb, the damage stays small and the event gets noticed.
A log a human can actually skim
The guardrail I lean on daily is the plainest one. Every agent narrates itself as it works: which tool it called, what it passed in, what came back, in ordinary language. When anything looks off, I am never guessing. I open the log and read, in order, the exact story of what the agent decided.
Two things come out of that. Problems get caught as they start, ahead of the damage. And over weeks the log teaches me the agent's habits, where it gets confused and which jobs it handles cleanly. The load bearing word is readable. A wall of dense machine output is nearly useless in the moment something goes wrong, so I make the agent explain itself the way a careful assistant would talk through a task. I will take a slightly slower agent that tells me everything over a fast one running in the dark, every time.
The cage has gaps, and pretending otherwise is the real risk
None of this makes an agent completely safe, and anyone claiming otherwise is selling something. A guardrail catches the failures you imagined in advance. A genuinely novel mistake, down a path you never considered, can still slip through. So no agent of mine holds power over anything where a single bad action would be a true disaster, however good the fences look. The cage buys a great deal. It does not buy the right to stop paying attention.
One more thing worth saying plainly. The purpose of all this machinery is to keep a person firmly in charge of everything that matters while the agent absorbs the tedium in between. I never wanted an agent that runs my life unsupervised. I wanted one I could trust with a narrow, well fenced slice of it, and the fence is what makes the trust possible.
Where I would start
If your use of AI is a chat window in a browser, none of this applies to you yet. The moment you hand a model real tools, it becomes the core of the project. The model is the easy part now. The hard part is the structure around it: the smallest possible tool set, a hard line between reading and changing, a human in front of the irreversible steps, rehearsals, ceilings, and a log you can read like a story.
Start with almost nothing, watch closely, and widen the fence one deliberate step at a time as the agent earns it. That is the unglamorous version of the agent story, and it is the only version I actually run. I write up more of these systems, including the failures, at [xavierfok.com](/).
Get new guides and videos first — join the Telegram channel.