Topic
Source-linked workflows that name guardrails. Part of the AI agent use cases on UsecaseBoard, or browse all use cases.
An Ask HN on controlling agents that take real actions converges on: LLM proposes → deterministic validator (rules, spend ceilings, replay checks) → human approve—especially for refunds, payments, and database writes where prompt 'never do X' fails.
OpenAI’s practical guide frames agents for complex judgment (fraud/refunds), brittle rule piles (vendor security reviews), and unstructured docs (home insurance claims)—not for simple deterministic checklists.
As major sites start blocking unauthorized agents, practitioners advise testing booking flows first and routing purchases through official agent paths—Yelp Places API, Shopify agent checkout, and Meta Muse partners like Walmart, Best Buy, and Sephora.
Show HN: Statewright's Rust engine enforces plan/implement/test states for Claude Code (and other CLIs) via MCP hooks—wrong tools are blocked structurally, shrinking death spirals for both small and frontier models.
An Indie Hackers founder almost shipped a no-auth “delete all users” endpoint Claude cheerfully wrote for a supposed test env—then built Thorim, a one-command layer of specialist agents/skills that makes coding agents challenge unsafe requests.
PATH-fronted proxies for terraform/aws/kubectl: TOML policies allow plan/read but block destroy/terminate/recursive deletes before the real binary runs—no LLM judgment in the safety path.
Beta plugin sits between the model and your app: write hard-deny/soft-deny/allow rules in prose; Armor evaluates every tool call (powered by a decision model) and blocks policy violations before bash/git/exfil runs—Claude Code auto mode works via Ori on any OpenRouter model.
MCP server plus local hooks route agent-written commits, PR text, emails and support replies into one editable queue; you rewrite and approve, then the agent sends exactly your version—Claude Code tested; Codex/Gemini/Copilot/Cursor installer-configured; free tier then paid.
Open-source MIT guardrail tracks audience×trust labels across tool calls (algebra, not LLM-as-judge), returns remedy plans (sanitize/authority/subagent) so agents keep ~90% task completion with 0% exfil on their benches—plugs via pre/post tool hooks; docs also as MCP.
The workflow scores incoming mail for prompt-injection patterns, routes high-risk messages to review, and uses Gemini for structured triage of the remaining messages.