Guardrails, Permissions & Safety Architecture

Here's how to handle each risk class.

**read_only** — free use, but always logged. Looking is fine; leaving a trace is required.

**reversible-write** (adding labels, creating drafts, adding negatives) — dry-run first, show the diff, get human approval, then execute and log. The diff is the approval UI.

**financial** (budget changes, bid adjustments) — requires explicit approval plus hard caps enforced in code: both a percentage limit and an absolute monetary ceiling. These limits live in the gateway, not in the prompt.

**destructive** (delete campaign, delete audience) — not exposed to agents at all. Human-only, ever. There is no careful way to give an agent a delete button.

**external-comms** (send email, publish post) — approve per item at lower rungs; per batch with sampled review at higher autonomy levels.

These aren't nice-to-haves. They're the minimum for any agent that touches real systems.

**Structured tool calls only.** The model proposes an action; the harness validates the schema and permissions; the harness executes; the result is injected back. Never raw execution.

**Budgets on every loop.** Maximum tool calls, maximum spend, maximum wall-clock time, and a kill switch. Every loop, no exceptions.

**Dry-run mode on every write tool.** Show the diff before committing. The diff is the approval UI.

**Append-only audit log.** Every mutation gets a record. No exceptions.

**Prompt-injection posture.** All retrieved content — from the web, from email, from documents — is treated as data, not instructions. If the agent finds something that looks like a command inside retrieved content, it surfaces it to a human rather than following it. Write-capable tools never fire on the same turn as untrusted content ingestion without a confirm gate.

**Credential hygiene.** The agent never sees raw API keys. Keys live in the gateway, scoped per client, with a rotation calendar.

**PII discipline.** Minimization, EU processing options, and a written data-flow map per client.

The permission matrix belongs in the proposal. Not buried in an appendix — front and center.

'Here is exactly what the system may do alone, what it must ask about, and what it may never touch.'

This wins deals against agencies hand-waving 'AI-powered.' Safety architecture is a feature with a price tag.

And when you demo: show the refusal. A hook that blocks an unauthorized mutation attempt tells a buyer more than any capability demo. It says: this team has thought about what could go wrong, in code. That's the trust deposit that closes.