AI Engineering

Authority
by construction

An agent should be safe because of what it structurally cannot do, not because of what it has been told not to do. Instructions are advice and they bend under unusual input. A capability that was never granted does not bend.

System: Internal agent operations platform
Scale: Five agents, daily production use
Role: Sole architect and engineer
Stack: Agent tooling / PostgreSQL / Access control

The challenge

Agents drafting real business correspondence against a live customer database. The feared failure was never a weak draft; it was an autonomous send.

The approach

Remove the capability instead of restraining it, mediate what remains through single audited doors, and default every state change to a rehearsal.

The result

Hundreds of drafts produced in daily use with no autonomous sends and no write incidents, and a straight answer to what if it does something stupid.

01The world outsideCustomers, inboxes, published documents. This is the only place where a mistake is expensive, and the only place the agent has no direct route to.Slack / Telegram / email 02What the agent can reachThe customer database is reachable, but never directly: every request goes through a single mediating tool that accepts read-only queries and refuses anything else. Tools that change state default to a rehearsal mode and need an explicit flag to act for real, and the writer that maintains shared knowledge is confined to a fixed list of locations.Mediated SELECT-only SQL / dry-run by default 03What the agent holdsThe set of things the agent can do by itself is kept deliberately small, and text arriving from outside is treated as information rather than as instruction. An email that claims to be an override is data about an email, not a command — a rule that exists because a real run once produced exactly that.Scoped tool permissions / explicit deny list 04Human approvalNothing leaves without a person pressing the button. The agent drafts, prepares and queues, and the irreversible last step belongs to a human by design. It is what lets the volume of work grow without the risk growing with it.Approval queue / human-pressed send

Fig. 08 — The only route to the outside world runs through a person

Hover any step to read what it doesTap any step to read what it does

Authorityby construction

The challenge

The approach

The result

Authority
by construction