# Safe Agent Changes Come From Guardrails and Observability, Not Trust Letting agents change production safely is an engineering-discipline problem, not a model-trust problem. Three controls do the work. **Guardrails that gate advancement** — "the controls that decide whether AI-generated code and AI-assisted changes are allowed to advance" — come in three types: human-in-the-loop approval for prod/high-risk/regulated changes; security evidence (scans, audit trail, deduped vulnerability propagation); and policy-as-code (OPA-style enforced rules like naming bound to Jira IDs), because agents invent their own workarounds unless a machine refuses them. **Blast-radius control** — AI explodes deployment size 4–20x, so feature flags plus CD turn a rollback into flipping one flag off, with 1% progressive rollout and a kill switch. **Observability for non-determinism** — "observability hasn't really changed, other than the fact that we now have to manage non-determinism," so you trace every reasoning step and tool call (OpenTelemetry), eval intent→outcome, and sample by risk. The connective tissue is *earned* permission. "Phased agent trust" gives an agent capability progressively: first advise and suggest root causes, then execute pre-defined runbooks in well-understood cases (restart on OOM), and only later touch destructive infra — each step gated on accumulated evidence, never the keys to the kingdom up front. And because AI is a DORA *amplifier* — "if the cracks were there before… they will continue to be there" — the work shifts from writing implementation to writing behavior specs the agent must satisfy, with correctness owned by the PR author (run the AI review locally; document what problem, how verified). <!-- atomicity: 1 idea ✓ --> ## Why This Matters For **[[AI Agent Safety MOC]]**, this is the practitioner-level checklist under the MOC's defense-in-depth thesis. [[3. Resources/Permanent Notes/Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] states the philosophy; this names the three layers that implement it for agent-driven *change* specifically — gate, contain, observe. "Phased agent trust" is [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] made temporal: bound what the agent may attempt, then widen the bound only as evidence accrues. The blast-radius layer *is* [[3. Resources/Permanent Notes/Default-Off Feature Flags Decouple Shipping Speed From Production Risk]] applied to agent output — flip the flag, not the deploy. And "behavior specs the agent must satisfy" needs an independent grader: [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]], since the agent that wrote the change can't be trusted to certify it. ## Counterpoints to Hold - **Guardrails can theater.** Policy-as-code and approvals look like safety while a rubber-stamp human and a permissive policy let everything through; the controls are only as real as their teeth. - **Phased trust is slow, and slowness has a cost.** Org pressure to "just let the agent ship" erodes the phases exactly when velocity feels good — the discipline decays under success. - **Tracing everything is its own bottleneck.** "Trace every step" collides with the volume problem; sample-by-risk helps but means accepting blind spots on the steps you judged low-risk. ## Links - [[3. Resources/Readwise/Podcasts/'Blame Nathan subscription service' - This Week in WordPress 383]] — applies-in: reversible, visible, human-approved publishing defaults implement guardrails at the WordPress product layer. - [[AI's Failure Mode Is Careless Adoption Not the Technology]] — applies-in: fixed review gates and observable changes are the operational answer to adoption practices that over-trust an AI label. - [[A Rule-Based DSL Over Object Metadata Is the Control Plane]] — applies-in: versioned match rules over operation metadata are a concrete policy-as-code layer for constraining agent actions. - [[3. Resources/Readwise/Articles/New in the Yoast SEO Bulk Editor filters, focus keyphrases, and AI drafts]] — product case where AI-generated bulk edits stay reviewable through explicit approval and per-change reversal - [[3. Resources/Permanent Notes/Defense in Depth Concedes Perfect Safety Is Impossible and Optimizes for Narrow Costly Monitored Failure]] — the philosophy these three layers implement. - [[3. Resources/Permanent Notes/Bounded Action Spaces Not Better Models Make Agents Safe to Run]] — "phased agent trust" is a bounded action space that widens on evidence. - [[3. Resources/Permanent Notes/Default-Off Feature Flags Decouple Shipping Speed From Production Risk]] — the blast-radius layer; flip the flag, not the deploy. - [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] — behavior specs need an independent checker. - [[3. Resources/Literature Notes/Meet the Community Agents - AI assistants for WordPress community workflows]] — applies-in: the Community Team's public-data limit, confidence labels, and mandatory human decisions implement guardrails and observability in a volunteer workflow. - [[3. Resources/Permanent Notes/Clean Code Is the Human-AI Interface]] — applies-in: enforceable code standards are a guardrail that makes agent behavior reviewable rather than a matter of trust - [[3. Resources/Permanent Notes/Notebooks Are JSON So Agentic Work Becomes an Auditable Memory Artifact]] — applies-in: notebook execution records and permission gates make agent changes inspectable instead of relying on trust in the model - [[Perm · Live-edge observability replaces static logs as the monitoring standard]] — applies-in: live telemetry supplies the early evidence needed to stop or contain an unsafe agent action before impact compounds - [[3. Resources/Permanent Notes/The Design File as a Programmable Bidirectional Surface for Agents]] — applies-in: bidirectional design-file access needs approval gates and observable changes before agent writes can be trusted. ## Open Questions - What's the right unit of "earned" trust — per-operation, per-runbook, per-blast-radius — and how do you revoke it when an agent regresses? - Behavior specs assume you can fully specify intent; for fuzzy product judgment, what does an executable spec even look like? ## Source - [Reader: Safe production changes with agents](https://read.readwise.io/read/01kv3sjgkwyc8ydjra3zq0te6m) — DORA amplifier; implementation→behavior-spec; correctness owned by PR author - [Reader: Do we need AI agents to fix our AI agents?](https://read.readwise.io/read/01kv3srr4dpc0g5qpf6cs4bbk7) — manage non-determinism; phased agent trust; OpenTelemetry tracing + evals - [Reader: How to build the guardrails your AI releases actually need](https://read.readwise.io/read/01kv3syx1e69z2k6bq8j6enz5g) — feature flags shrink blast radius; the 3 guardrail types (human-in-loop / security / policy-as-code) - See also: [[AI Agent Safety MOC]]