There is one answer that should end a meeting: "our agents are smart enough to handle that". A language model produces a plausible answer, not a verified one. It will be wrong. What sets a serious architecture apart is what has been planned for that moment.

The lesson we paid for

We run agents that act on real advertising accounts. One day, a perfectly clear instruction had been written into the agent's brief: never touch one specific term. A few hours later the agent touched it anyway. The instruction was not ambiguous, it was simply in the wrong place.

A prohibition written in an instruction is a wish. A prohibition written in code is a rule.

Since then, every hard prohibition is enforced by deterministic code, outside the model, on the path of the action. The model can propose whatever it wants: if the proposal touches a protected item, it is refused before it reaches the external system, with a recorded reason. That is the most important principle in this article.

The mechanism, layer by layer

  • Deterministic rules upstream. Anything that can be checked without a model is checked without a model: format, value range, consistency with what exists, protection lists.
  • A business check before the action. The proposal is compared with the real state of the system: would this action destroy something that works, would it cross a threshold, would it contradict an earlier decision.
  • A confidence threshold. Below it, the machine does not decide: it hands over, explaining what makes it uncertain.
  • An explicit fallback. When the model is unavailable or too slow, the process does not stop halfway: it switches to a degraded behaviour that is known and documented.
  • A complete log. Every action carries its author, its reason, its cost and its result. Without that log no error can be analysed, so none can be fixed.
  • An alert. Abnormal cases reach a named human immediately, not in a monthly report.
  • A real undo. A refusal must undo what was done, not merely record an opinion.

Undoing for real

This is the point we suggest digging into with any provider. On our advertising agents, every proposed action reaches the human with two buttons. "I agree" confirms. "I disagree" does not simply record an opinion: it undoes the action when it is reversible, it records the prohibition so the same proposal does not come back, and it sends a confirmation, including when the undo failed.

That last detail is the most telling. An undo that fails silently is worse than no undo at all: it creates the feeling that the subject is handled.

Tests, built from real errors

Our safeguards are covered by automated tests whose cases come from incidents we lived through, not from imagined scenarios. An error seen in production becomes a test, which guarantees it will not come back through the same door. It is a simple question to ask a provider: are your safeguards tested, and on which cases.

What has to be accepted

None of these mechanisms brings the error rate to zero. They do something else, and that is what counts: they make errors visible, bounded and repairable. A company deploying AI without that layer is not deploying AI, it is deploying exposure.