Guardrails are never enough protection for critical paths
- Published
- 09/04, 11:02
- First discovered
- 09/04, 15:00
- Type
- Dev community · RSS
The discussion highlights that guardrails alone are insufficient for critical paths, especially concerning financial transactions. The author recently rerouted database writes through a broker for citation and permission checks. It's suggested that a wallet should enforce spending controls, including maximum amounts per request, daily caps, total caps, and authorized hosts, stopping payments before money is moved when a cap is reached. The conversation prompts reflection on where hard spending controls are currently implemented.
I recently removed direct database writes from one of my agents and required every write to go through a broker that checks citations and permissions.
The agent’s instructions already explained what it was allowed to write. That was useful guidance, but I did not want an instruction to be the only thing protecting the database. We all know how sketchy that is. A model can misunderstand the instruction, carry stale context into a later step, or simply make a bad judgment. If the write matters, the boundary has to live where the write actually happens.
The broker now checks the proposed change before it reaches the database. It can reject a write with missing citations, block a write outside the agent’s permissions, and leave a record of why the decision was made. The prompt still matters. Enforcement has moved into the broker.
Agent spending should work the same way.
A prompt can say “do not spend more than $5.” That sentence is still an instruction inside probabilistic context. The wallet should know the maximum amount per request, the daily cap, the total cap, and the hosts the agent is allowed to pay. When a cap is reached, the next payment should stop before money moves.
I do not think this is optional infrastructure for agents that can buy things. Any limit that exists only in the prompt is advisory. The hard boundary belongs at the point where the irreversible action happens.
I am building a wallet for agents, so I am not neutral on this. The database broker made the pattern much clearer to me because the same rule applies in both places. Instructions guide the agent, while infrastructure decides what the agent can actually do.
Where are you putting hard spending controls today? Are they in the tool wrapper, a proxy, a wallet, or still mostly in the prompt?