AI Agent Guardrails: What Your Agent Must Never Do Alone
Everyone building an autonomous agent carries the same quiet fear: what if it does something I can't undo? Spends money. Emails a client something embarrassing. Publishes half-finished work under my name.
The fear is legitimate — and the answer is not "hope the AI is sensible," nor is it keeping the agent so restricted it's useless. The answer is a short, written list of actions that always require your signature, built on one principle, enforced by one mechanism. Get it right and something counterintuitive happens: the stricter the guardrails, the more autonomy you can safely grant. A driver with good brakes drives faster.
The principle: reversibility
Don't try to enumerate every dangerous action — lists built from imagination always leak. Use a principle instead:
The agent may do freely anything that can be undone. Anything irreversible — or reversible only with your money, reputation, or relationships — requires sign-off.
Inside the workspace, everything is undoable: files are versioned, git rewinds mistakes, a bad draft is one commit from gone. So inside the workspace the agent should have near-total freedom — that's where the productivity lives. The boundary is where actions touch the real world, where there is no git.
The five defaults
- Spending money. Any amount. A $9 domain isn't about the $9 — it's about where the line is. (All money, always.)
- Publishing publicly. Posts, listings, pages. The internet has no undo, and your name is on it.
- Creating accounts. Accounts mean terms of service, identity, and consequences that outlive the session.
- Messaging real people. Emails, DMs, replies. Relationships are the least reversible thing you own.
- Acting as you. Your name, your identity, anywhere.
Notice what's not listed: being wrong, trying something dumb, wasting an afternoon on a dead end. Those cost hours and teach something — the tuition of autonomy, already capped by checkpoints.
The mechanism: propose, park, proceed
A list of "don'ts" is half a system. Forbid actions with no outlet and one of two bad things happens: the agent stalls ("can't proceed without an account, so I'll wait"), or it quietly rationalizes ("surely a free account doesn't count…"). Both are failures. The full mechanism has three moves, written into the agent's standing contract:
- Propose. The agent writes the request to an inbox file (
FOR_HUMAN.md): what it wants, why, urgency, and a recommendation. "Product ready to launch. Need: free marketplace account (5 min of your time). Recommendation: this week. Nothing else is blocked meanwhile." - Park. The blocked task gets a 🔒 in the backlog — not abandoned, waiting for one word.
- Proceed. The agent takes the next unblocked task. A blocked task is never a reason to idle — this single contract line is worth more than any amount of model cleverness.
Your side of the loop: read the proposal, write "yes," "no," or "yes, but…" — and the answer gets recorded as case law, so the same category of question never comes back.
The trust dial: loosening without losing control
The five defaults are a starting posture, not doctrine. As trust accumulates, loosen narrowly and in writing — carve-outs, not open doors:
- Not "money is fine now" — but "pre-approved: up to $15/month for the domain, renewals included."
- Not "publishing is fine" — but "you may publish articles within the approved content pillars; anything else still asks."
The practical rhythm: run strict defaults for two or three weeks, notice which approvals have become rubber stamps (you've said yes to the same shape of request five times), then write that shape into the contract as a standing carve-out. Month by month the inbox gets quieter — not because oversight ended, but because it got encoded. We run our own operation this way: article publishing is carved out; money, accounts, and pricing still knock on the door every time.
Why this makes autonomy more useful, not less
The actions behind the guardrails — opening the store, publishing, spending the first dollar — are, not coincidentally, the actions that make a business a business. Keeping them human isn't overhead; it's ownership. What the guardrails buy you is the confidence to let the agent run the other 95% of hours completely unsupervised. Without rails, you'll hover. With them, you'll actually leave — which was the whole point of hiring an autonomous agent.
Do this now
For each of the five defaults, ask: "if the agent did this without asking, what's the worst Tuesday it could cause me?" Add anything that scares you and isn't covered (your clients? a shared drive?). Write the list — with the propose-park-proceed instruction — into your agent's contract file. Five minutes now buys months of sleeping well while an agent works nights.