The agent that writes the check that blocks it
When the same agent writes the fix and the gate, the gate agrees by construction. RED before GREEN is what makes a machine-written check mean anything.
guardrails
26 posts
Where to put the human
Gate placement for autonomous agents. Reversibility is the criterion, not confidence, and the consent surface matters as much as the question.
A gate that fixes what it finds
An auto-healing loop must fix the source, never the symptom, and must never edit the thing that found the problem. Confidence floors and bounded rounds.
Six guardrails that stop my AI agent mid-command
Six PreToolUse hooks that refuse an agent's command before it runs. What each one caught, and why a guard the agent can talk its way past is not a guard.
A verification step that can pass while the bug is present is not a verification step
Static checks read what was written; the defect lives in what was drawn. Four artifacts that passed every gate this session and failed the moment someone looked.
Teaching an agent when to stop
Enumerated halt classes make stopping checkable; a mood does not. The forbidden reasons that stall a drive, and the undeclared halt I made anyway.
The agent said 'fixed'. The list said otherwise
A delete returned deleted:true while the item was still there. Four failures in one day shared a shape: the action reported on itself, and nothing read the state back.
A test that cannot fail is not a test. Mine passed twice.
A RED test fixture that passed because a comment explaining the omission contained the omitted string. The failure mode is generic: any test whose input mentions what it removes.
Design for the API call you cannot take back
An API with create but no delete changes where your guards live. Four checks that run before the request, and the one that only exists because a create returns 201 on the wrong target.
Telling an AI agent your rules does not make it follow them
Seven guards fired on me in one session, each blocking a command I had already decided was fine. That gap between deciding and being allowed is the whole argument for hooks.
Every action your AI agent takes should be safe to run twice
Agents retry after ambiguous failures, so every action needs to be safe twice. Ledgers, content checks and dry runs — and the create that is genuinely not idempotent.
The command that leaked a secret was not cat
I leaked an OAuth token by running a command designed to print only field names. The file was malformed, so the field name was the secret. Verb denylists cannot catch this shape.