By Starktronix EngineeringNotes from our own systems
Listen to this article · 3 min
The question people ask about agentic systems is how much they can be trusted to do. It is the wrong question, and answering it well still leaves you with a system nobody should deploy.
The right question is what happens at the boundary — the moment an agent moves from preparing something to committing it. Everything interesting about safety, auditability and organisational trust lives at that line.
The rule
Every agent we operate can draft, propose and prepare. No agent can approve, greenlight or release. There is no capability tier, no trusted-agent exception, no override for a model that has been reliable for six months.
Agents
Draft, propose, prepare
No capability tier or trusted-agent exception changes this.
Humans
Approve, release, commit
The write action itself always passes through a human.
- An agent can write a card. A human moves it out of draft.
- An agent can prepare a reply. A human sends it.
- An agent can assemble a case for a decision. A human takes it.
Where the rule lives
This is the part that matters, and it is the part most implementations get wrong. The boundary is not in the prompt. It is in the authorisation layer — the same row-level policy that governs human users, applied to machine actors as a distinct kind of principal.
An agent that has been told not to do something is an agent that has been asked nicely. An agent whose credentials cannot perform the write is an agent that cannot perform the write, regardless of what it decides, what it is convinced of, or what an input persuades it of. The failure mode of instruction is persuasion. The failure mode of policy is a rejected transaction.
A prompt is a suggestion. A policy is a guarantee. Only one of them survives an adversary.
We got this wrong first
Our earliest version enforced the boundary in application code — the route checked whether the caller was an agent and set the draft flag accordingly. It worked until a different route reached the same table without that check, and agent-authored records started landing already approved.
The lesson was not to add the check to the second route. It was that any boundary enforced in the layer above the data will eventually be bypassed by a path that forgets, because paths multiply and memory does not. The check moved down to the row policy, where every path has to pass through it whether it remembers to or not.
Boundary enforced in application code
One route checked whether the caller was an agent and set the draft flag accordingly.
A second route bypassed it
It reached the same table without that check.
Agent-authored records landed approved
The application-layer check simply didn't run on that path.
Fix: move the check to the row policy
Every path has to pass through it whether it remembers to or not.
What it buys
Oversight that does not degrade with scale. The bottleneck in supervised autonomy is human attention, and attention does not scale — but structural constraint does. Ten agents and a hundred agents are the same governance problem when the constraint is architectural, and completely different problems when it is attentional.
It also makes the audit trail meaningful. Every release has a human on it. Not as a rubber stamp recorded after the fact, but as the transaction that actually performed the write.