The model proposes, code disposes
A guardrail pattern for business agents: let the LLM classify and draft, but put every consequential rule in deterministic, tested code.
When an agent touches email, money or people, "the model is usually right" is not a safety argument. The pattern I used for an HR inbox agent splits the work:
| Step | Who decides | Why |
|---|---|---|
| Detect automated mail, spoofed Reply-To, bank-change wording | Code | Cheap, certain, runs before any model call |
| Classify, flag risks, draft a reply | Model | Language is what models are good at |
| Send, draft or escalate | Code | Rules must be auditable and testable |
The holds
A reply goes out automatically only if all of these pass: an auto-reply category, no risk flags from model or code, the model marked it safe with high confidence, no decision wording (offers, rejections, interview invites), a reply exists, no auto-reply to this sender in 24 hours, and the agent is in auto mode.
Make doubt less permissive
The JSON parser is deliberately pessimistic: an unknown flag, a missing field or a non-true safety value all push the outcome towards review, never towards send.
Measure the failure that matters
Accuracy is a vanity metric for agents. The evaluation harness also counts unsafe outcomes — emails that should have escalated but would have been auto-sent. Across three runs on fixtures that number was zero, and it is the number that decides whether the agent leaves draft mode.
Treat input as hostile
The email is wrapped and labelled as untrusted, and the model has no tools. Even a perfect prompt injection can only change a proposal that code then inspects.
Keep reading
How I build with AI agents in the loop
AI writes a lot of my first drafts. Here is the workflow that keeps me — not the model — accountable for what ships.
Oct 2026
Trust ladders for business agents
Autonomy should be earned per task: observe, suggest, draft, act with approval, act and report. Notes from prototyping an agent control plane.
Jun 2026