Guardrails

Guardrails by design, not by fence.

Deterministic where it can be. Judgment only where it must be.

A fence is something you put around an agent afterward. A design is something you can explain.
Some agents need a fence. Some don't. It depends on what they can reach, and that's decided before they run.

Six principles

An agent is defined by what it can reach, not by what it's for. We don't ask what an agent does. We ask what it can touch. An agent can't disturb, break or destroy what it can't reach.
The thing with the keys has no judgment. The thing with judgment has no keys. The part that can act follows a fixed script. The part that can think can't act on its own.
No single agent can both get a credential and use it. Obtaining and spending live in different places. Compromise either one and nothing gets published.
If an agent is compromised, the attacker gets what it had. Nothing else. An agent holds a short-lived credential to exactly what it was granted, and can't learn what else exists.
Every credential was handed over by a person, for a stated reach, for a stated time. Humans hold the master keys. Always.
Two walls that fail for different reasons beat one thick one. A wall that fails one way and a wall that fails another way don't fail together.

A task is a script unless it needs judgment. Most don't.

Counting, comparing dates, matching a pattern, calling a system with known inputs: a script. It's right by construction, and when it's wrong there's a line to read.
Reading what a person wrote, deciding what it means, writing back: a model. That's where judgment earns its place.
When something breaks, the model says what broke. It doesn't improvise a fix. It doesn't go looking for another way through.

Give an agent no boundaries and it'll set its own. Give it a script and it can't.

What an agent did is written down somewhere the agent can't reach. Its own record outlives it, and it can't touch it.
Written once, never revised. You can always see what happened, and what it looked like before anyone explained it.
That's an audit trail, and it's there whether or not anyone ever asks for one.

None of this came off a whiteboard. It got built in the middle of live work, on real deadlines, with real money on it.
Some of the wrong answers were mine. They're in the record too.