The uncomfortable truth about agentic AI: an agent that's right 95% of the time and unsupervised is more dangerous than a chatbot that's right 80% of the time, because the agent acts. It sends the email, updates the record, issues the refund. Guardrail design is therefore not a safety add-on — it's the core engineering discipline of agent development.
The patterns we build into every agent
- Typed tool contracts. Every tool the agent can call has a strict schema, validated before execution. The agent cannot pass a free-text SQL string; it passes structured parameters that the tool validates and executes itself. Most catastrophic agent failures are really unvalidated tool calls.
- Bounded loops and budgets. Hard caps on steps per task, tokens per task, spend per task, and wall-clock time. An agent that exceeds its budget doesn't try harder — it stops and escalates with its trace attached.
- Permission scopes per action, per tenant. Read access is cheap to grant; write access is scoped to exactly the records the current task touches. In multi-tenant systems this isolation is non-negotiable: agent A must be architecturally incapable of touching tenant B's data, not merely instructed not to.
- Risk-tiered approval gates. We classify every action: reversible and low-cost runs autonomously; irreversible or expensive queues for one-click human approval with full context. Over time, as measured accuracy on a tier rises, its threshold can be loosened — authority is earned with evidence, like a new hire's.
- Traces as a first-class output. Every decision, tool call, input, and output is logged in a structured trace. When an agent misbehaves, the question "why did it do that?" must be answerable in minutes from the trace, not reconstructed from guesswork.
Failing safely is a feature
A well-designed agent has a defined behaviour for every failure: tool timeout, ambiguous instruction, low-confidence extraction, exceeded budget. In each case it degrades to a known-safe state — usually "summarise what happened and hand to a human" — rather than improvising. Ironically, teams trust agents with more autonomy precisely when the agents demonstrate they know when to stop.
This is the discipline behind everything on our agentic AI development page, and it's why our automation pipelines ship with confidence thresholds and review queues rather than blind straight-through processing.