Guardrails in the Call Path: Designing Ethical Constraints into Agentic Systems
Most agent incidents I have cleaned up were not the model going rogue. They were an agent doing exactly what it was told, fast, against the wrong target. A retry loop that re-sent the same 400 emails. A cleanup job that read "remove stale records" generously. The model worked fine; the system around it had no opinion about what it was allowed to touch. In production, "designing ethics into the system" means deciding which actions an agent may take, then enforcing that decision somewhere the model cannot reach.
Put the Constraint Where the Action Is
"Be careful with destructive operations" in a system prompt is a request, not a control. The moment your agent reads a support ticket or a customer's PDF, untrusted text sits in the context window next to your instructions with equal standing. So I treat model output as a request, never a decision — the executor decides. The constraint lives in the tool. The delete tool soft-deletes and nothing else. The payment tool's cap is a number in code. The database role the agent runs under cannot see the tables it has no business reading. You can talk a model out of an instruction. You cannot talk it past an IAM policy.
Tier by Blast Radius
The expensive mistake is treating every action with equal suspicion. Gate everything behind human approval and you have built a slow copilot that people route around inside a week. Gate nothing and one bad run puts you in a very specific conversation with legal. I sort actions on two axes: reversible or not, cheap or not. Reversible and cheap — let it run, log it. Reversible and expensive — let it run, alert someone, keep the undo path warm. Irreversible — a person confirms, every time, however confident the model sounds. Multi-model consensus and second-pass reviewers do work, but they roughly triple token spend. Buy that where a mistake costs real money.
Where to Start
Log every tool call and its arguments. At 3 a.m., "the agent decided to" is not an incident report — you need the exact arguments it passed, and that trace is also what carries you through a security review six months later. Then list every action your agent can take and write down what it costs to undo each one. That column is your design document: anything expensive to undo gets a hard constraint in code, a default-deny permission, and a cap. The agent I am willing to leave running is not the most capable one I could build. It is the one whose worst case I can state in a single sentence.