Guardrails: what an agent may never touch

Telling an AI agent not to do something is the weakest way to stop it. 2501 bounds every agent with five independent layers, and only one of them (your operational rules) is an instruction to the agent. The strongest is the access the agent holds: an agent without the right to delete something cannot delete it, whatever a ticket or a model says.

This is the page to point a security review at.

Five layers

• Access is the hard cap. Each agent reaches your systems through its own account, with only the permissions its job needs. A reporting agent gets read access and nothing more. It is the one layer that does not depend on software behaving as intended.
• The blacklist involves no AI judgment. Every command is checked against a list of forbidden actions before it runs, whatever the host, specialty or mode. An agent that keeps trying a blocked action is stopped.
• Read-only is enforced, not requested. In investigate-only mode, a second, independent check reviews every command before it runs and blocks anything that would change the system.
• Your operational rules add your own limits: which systems are in scope, what needs a person first, and which change windows apply.
• Every job is bounded. If the problem is not solved within a fixed amount of work, the job stops and says so.

How much autonomy, and who decides

Autonomy is a ceiling you set per specialty: investigate only, act after a person confirms, or act on its own within your rules. Because the ceiling belongs to the specialty rather than to the ticket, the wording of a ticket cannot raise it. A request to fix something that a specialty may only investigate is answered with what the agent found and why it did not act.

Start any new specialty investigate-only, watch its plans for a week, and raise the ceiling only when they consistently look right. When you do, widen its access and its rules together.

Frequently asked

What stops an agent running a destructive command? The blacklist, checked before every command without any AI judgment. Beneath it, the agent's own access limits what it could do.

Can an agent be talked into doing something it should not? Instructions can be manipulated; access cannot. An agent without permission to make a change cannot make it.

Can a read-only agent be talked into acting? No. A specialty set to investigate only stays read-only however a ticket is worded.

Related

• Read-only AI investigation