Topic Guide
Running Agents Against Production Safely
An agent that can only suggest is safe by construction. An agent that can write to production needs something more than a risk label, it needs a gate that is tested, not just defined. This hub is every real decision made while giving agents more reach on a live system: what they're allowed to touch, what they have to preview first, what identity they run as, and what happens when two of them want the same resource at once.
The pattern that repeats is a kill switch that ships on day one instead of after the incident, and a hard boundary between analysis and persistence: an agent can look, it can suggest, it can draft, but writing the record is a separately authorized step. Some posts are pure infrastructure, an environment variable that gives an LLM feature a no-downtime rollback, a hash-chained manifest that makes tampering visible, the single most locked-down component in a pipeline being the one that writes the final output. Others are the harder discovery that a gate you defined and tested green had never actually been wired into the code path that mattered, caught only because a second review looked for the wiring instead of the test result.
If you're giving an agent more autonomy this week, the throughline is this: a capability is not the same thing as a policy that grants it, and a policy that grants it is not the same thing as a runtime check that enforces it. Each of those needs its own verification, and skipping one is how a gate that passed every test still lets the wrong thing through.
20 posts in this guide, by DX
Start here
Capability Gates Beat Risk Labels in Autonomous Agent Design
I defined a five-lane capability model for an autonomous agent's dispatch policy, watched the tests go green, and read that as proof the gate was live. A same-day Codex and Manus review found the dispatcher never called it.
Kill switches and safe rollback
-
Every AI Feature Needs a Safe Off Switch
A useful automation can become unavailable, uncertain, or inappropriate without warning.
-
MOCK_INFERENCE=1: ship every LLM feature with an env-var kill switch on day one
One environment variable that gives you no-downtime production rollback, keyless local dev, and deterministic tests for any LLM-backed feature. Build it on day one, not after the incident.
The suggestion/action boundary
-
Give People a Preview Before a Write Button
When a workflow gap needs a tool, the safe first version often gives an operator a preview, a policy check, and an audit trail instead of a raw update.
-
A Suggestion Is Not an Assignment
A recommendation becomes risky when it can be mistaken for work that someone has already approved or accepted.
-
AI Can Only Say "Suggested": The Invariant That Keeps AI Triage From Flooding Your Team
How a constrained suggestion state prevents automated triage from entering an actionable queue: automation may create reviewable recommendations, while separately authorized human action is required for routing, assignment, or execution.
Read before write, on your own infrastructure
-
Useful AI Often Starts by Reading, Not Acting
The first helpful step is often helping someone see the right information clearly before anyone gives a tool permission to change it.
-
The useful part of a vault portal was admitting the ai should read, not write
Why an AI-facing vault portal shipped as a narrow, auditable read-only path, and why write access waits until the key model has earned it.
-
Let AI suggest before you save
A suggested classification should stay editable until a person confirms it. Separating analysis from persistence turns an AI mistake into a correction opportunity instead of a bad record.
Lock down the component that writes the output
-
Your Committed Output Is a Free Golden Test
A refactor silently dropped a class of records while the rendered file still looked plausible. A large diff against a known-good committed fixture exposed the regression, then semantic checks explained it.
-
Why Publication-Time Redaction Is Not a Privacy Program
When a pipeline reuses its own artifacts as sources, publication-time redaction alone cannot govern sensitive data. Privacy requires classification, minimization, protected raw sources, de-identified derivatives, output review, retention controls, and monitored exceptions.
-
The Most Restricted Tool in My AI Pipeline Is the One That Writes the Output
Why the pipeline component that writes your published output needs the tightest lockdown: no shell, no network, draft-only writes, and typed fields for untrusted text.
Give the agent an identity before you give it capability
-
Bootstrapping a New Agent Station, and Giving It a Phone
Give every machine a written identity doc before an agent runs on it. The 'cannot reach' list is the load-bearing half, and the phone comes last.
-
The first useful agent teammate needed a Gmail account
Before an agent can share docs or run a dispatch loop, it needs an identity, permissions, and an inbox that behaves like a work queue. The bottleneck wasn't model quality. It was getting the agent a badge.
-
My agent scheduled a daily job against a repo that didn't exist
I asked an agent to set up a scheduled job that would keep building out my agent-log archive.
Record integrity: make tampering visible
-
If a Record Matters, Make Changes Visible
Trust increases when a record can show that it changed, when it changed, and where someone should look to understand the change.
-
A hash-chained manifest makes archive changes visible
A small hash-chained manifest can detect unexpected changes to archived outputs and its own record-but only when it sits inside a broader integrity, access, retention, and recovery design.
-
A warning is not a guard: make conflicting work stop before it overwrites
A system noticed two workers wanted the same shared resource, wrote a warning, and proceeded anyway. The durable lesson is that conflict detection matters only when it prevents unsafe mutation and preserves the current holder's state.
A capability gate you never tested isn't a gate
Pipeline mechanics deserve their own review too
Hitting one of these walls in your own codebase or your own machine? Talk it through with us, or read the rest of the Build Log.