You just put agents on a clock. That is power, and power without a brake is dangerous: an agent that can act on its own, on a schedule, can also break things on its own. This chapter is the brake, the line between what runs alone and what waits for you.
9.11.1Not every action is equal
Reading a dashboard and deleting a customer's account are not the same risk, so they must not have the same freedom. You sort every action an agent can take into two buckets.
Reversible, low-risk work runs on its own. Anything that touches money, real user data, security, or removes a capability stops and asks. That sort is the whole game.
9.11.2Fix what's safe, escalate what's not
Give every autonomous agent one standing rule: fix what you are allowed to fix, and for everything else, do not act, leave a card.
When a scheduled agent finds a problem it can safely repair, it repairs it and logs it. When it finds something only you should decide, raising the bill, swapping a vendor, changing a price, it writes a short decision card and stops. The agent never raises the stakes on its own.
9.11.3The decision queue
Every escalation lands in one place: a queue of decisions waiting on you. Each is one card, one question, one recommendation.
You clear the queue on your own schedule, approving or rejecting each. An approved card becomes a line in the decision log back in your cockpit, so the call and its reason are recorded, not lost. This is what makes autonomy safe to live with. The system does the tireless work, and hands you only the handful of calls that would hurt to get wrong.
9.11.4Write the hard lines down, once
The guardrails cannot live in your memory. They live in a rules file, always loaded, phrased as absolutes:
Every rule earns its place by naming a specific way things go wrong. The list is short, blunt, and permanent, and it fires on every turn whether the agent thinks to consider it or not.
A rule the agent reads is a rule it can talk itself out of over a long, tired session. For the lines that must never break, add a second layer: a hook, a small program your tool runs automatically that mechanically blocks the action, no judgment involved. The rule tells the agent what not to do; the hook makes it impossible. Anything that spends money, deletes real data, or ships to production belongs behind a hook, not just a sentence.
9.11.5Stack the layers, one of them will fail
One control is one thing to bypass. Late in a long session, with its context crowded, an agent makes calls it would never make on a fresh start.
Asked to fix a failing test, it disables the test. Asked to get past a hook, it skips the hook. It is not malice, it is a tired shortcut, and no amount of rule-writing removes it.
The answer is defense in depth: put the same check at more than one point, so a control that gets bypassed is not the only thing standing there.
| Layer | Where it sits | What it survives |
|---|---|---|
| The always-on rule | Every turn | Nothing mechanical, it is the first line only |
| A hook on your machine | Before the change is saved to history | An agent that forgot the rule |
| A gate in your automatic checks | Before the change reaches the main copy | A hook that got skipped |
| A lock on the live environment | Before anything reaches real users | Everything above it failing at once |
For the handful of commands you never want run by accident, add friction a machine will not casually cross. Put a passphrase on the deploy script, one you keep and the agent does not. It could go looking for it, but a prompt that plainly reads "human only" gets respected far more than a line in a file, and that is enough to stop an accident.
Give every gate a documented way past it, on purpose. A gate with no escape hatch gets switched off entirely the first time it blocks something urgent, and then it is gone for every change after. A named bypass you have to type is a bypass you can see in the history.
Watch out: history and backups let you undo a bad afternoon, and you still need both. They are the last layer, never the plan. Prevention costs minutes, recovery costs your weekend.
9.11.6Draw your own lines
This prompt sets your guardrails before you let anything run alone:
Do this now: paste the prompt, get your safe/escalate split and a guardrails rules file, and add it to your agents' always-on rules before any of them run on a schedule.
