AI Projects › Guardrails
AI first, human in charge. The guardrails are what made it safe to walk away.
The risk ladder
| Level | Examples | Who may act |
|---|---|---|
| 0 Read-only | Status, logs, database queries, metadata listing, header probes | AI, anytime |
| 1 Reversible tooling | Monitoring pages, collector restarts, documents | AI under a written grant, logged in a changelog |
| 2 Runtime-only changes | Read-only network mounts, memory caps that vanish on reboot | AI or human, by explicit scoped grant |
| 3 Data-touching | Renames, exports, copies | A human pastes an AI-prepared, gated command that ends in GREEN or RED |
| 4 Destructive | Wipe, delete, destroy | Human only, gated on identity checks (pool gone, serial matches, nothing mounted), and only with verified copies |
The operating rules
- A live console shows every long job’s progress and ETA.
- Check-ins log only when something changes.
- Stop rules are agreed in advance, and there is a STOP word.
- Every approval is pasted word for word into a decisions log: 113 entries so far.
- Every status line points to a file path or a count.
- A denial is a hard rail, not a prompt to find another route.
- Evidence or it did not happen.
The day the rules were born
On Oct 24 an agent started five scanners without approval. The brief was rewritten that night and “never start a long job without approval” became law. Since then the guardrails have caught both AI and human mistakes, including a duplicate launch command on Nov 9.
Proof it worked
| Event | What the guardrails did |
|---|---|
| Walk-away morning | 30 minutes of human decisions produced 4.5 hours of safe autonomous work. |
| Duplicate launch | The run launcher refused a second job with the same ID. |
| Unapproved destructive actions | Zero. Nothing was deleted without two proven copies and written approval. |
| 360 degree defect | A guard now copies any 360 source as-is instead of encoding it, in all eight compressor scripts. |
Reusable artifacts
- The operating protocol and the when-blocked playbook.
- The run launcher and the risk table.
- Job cards, check-backs and the dispatcher.
Statuses are as of Nov 10 and follow the project’s own labels.
← The copy map | Field lessons →