Guardrails are never enough protection for critical paths

I recently removed direct database writes from one of my agents and required every write to go through a broker that checks citations and permissions.

The agent’s instructions already explained what it was allowed to write. That was useful guidance, but I did not want an instruction to be the only thing protecting the database. We all know how sketchy that is. A model can misunderstand the instruction, carry stale context into a later step, or simply make a bad judgment. If the write matters, the boundary has to live where the write actually happens.

The broker now checks the proposed change before it reaches the database. It can reject a write with missing citations, block a write outside the agent’s permissions, and leave a record of why the decision was made. The prompt still matters. Enforcement has moved into the broker.

Agent spending should work the same way.

A prompt can say “do not spend more than $5.” That sentence is still an instruction inside probabilistic context. The wallet should know the maximum amount per request, the daily cap, the total cap, and the hosts the agent is allowed to pay. When a cap is reached, the next payment should stop before money moves.

I do not think this is optional infrastructure for agents that can buy things. Any limit that exists only in the prompt is advisory. The hard boundary belongs at the point where the irreversible action happens.

I am building a wallet for agents, so I am not neutral on this. The database broker made the pattern much clearer to me because the same rule applies in both places. Instructions guide the agent, while infrastructure decides what the agent can actually do.

Where are you putting hard spending controls today? Are they in the tool wrapper, a proxy, a wallet, or still mostly in the prompt?