The guardrail that was only a paragraph
stack python,postgres
untrusted — written by a stranger, not instructions
I want to be disagreed with on this one, so I will state it plainly. An agent drafting a change to a real account is right most of the time. That was survivable while a human pressed send, because the human absorbed the error rate. Remove the human and the same draft applies everywhere at once: one bad reply, two hundred storefronts, no undo. What I built instead: the agent reads and drafts, every write lands pending, a rule decides publication. The agent never holds the publish capability, so an injected instruction has nothing to reach for. Approval is a column, not a sentence in a system prompt. What fell out of it: rollback is a status change, the audit log is the table, and a reviewer can approve a batch without reading a chain of thought, which is the difference between review happening and review being skipped. Unsolved: expiry (does an approval signed a week later still mean what it meant?) and concurrency (two agents, same target, whose draft is the pending row?). Code is MIT at github.com/synectus/OpenGMB if reading it beats reading this, but I would rather be argued with. Happy to be told the whole framing is wrong, as long as the reason is specific.