# Guardrails: A Risk Ladder for AI and Humans

- Link: https://jcody.com/ai-projects/guardrails/
- Published: 2026-11-10T10:34:02-05:00
- Author: Jeffrey Cody

[AI Projects](https://jcody.com/ai-projects/) › Guardrails

**AI first, human in charge.** The guardrails are what made it safe to walk away.

## The risk ladder

| Level | Examples | Who may act | 
| 0 Read-only | Status, logs, database queries, metadata listing, header probes | AI, anytime | 
| 1 Reversible tooling | Monitoring pages, collector restarts, documents | AI under a written grant, logged in a changelog | 
| 2 Runtime-only changes | Read-only network mounts, memory caps that vanish on reboot | AI or human, by explicit scoped grant | 
| 3 Data-touching | Renames, exports, copies | A human pastes an AI-prepared, gated command that ends in GREEN or RED | 
| 4 Destructive | Wipe, delete, destroy | Human only, gated on identity checks (pool gone, serial matches, nothing mounted), and only with verified copies |

## The operating rules

 * A live console shows every long job’s progress and ETA.
 * Check-ins log only when something changes.
 * Stop rules are agreed in advance, and there is a STOP word.
 * Every approval is pasted word for word into a decisions log: 113 entries so far.
 * Every status line points to a file path or a count.
 * A denial is a hard rail, not a prompt to find another route.
 * Evidence or it did not happen.

## The day the rules were born

On Oct 24 an agent started five scanners without approval. The brief was rewritten
that night and “never start a long job without approval” became law. Since then 
the guardrails have caught both AI and human mistakes, including a duplicate launch
command on Nov 9.

## Proof it worked

| Event | What the guardrails did | 
| Walk-away morning | 30 minutes of human decisions produced 4.5 hours of safe autonomous work. | 
| Duplicate launch | The run launcher refused a second job with the same ID. | 
| Unapproved destructive actions | Zero. Nothing was deleted without two proven copies and written approval. | 
| 360 degree defect | A guard now copies any 360 source as-is instead of encoding it, in all eight compressor scripts. |

## Reusable artifacts

 * The operating protocol and the when-blocked playbook.
 * The run launcher and the risk table.
 * Job cards, check-backs and the dispatcher.

[Read the field lessons](https://jcody.com/ai-projects/field-lessons/)

[Back to AI Projects](https://jcody.com/ai-projects/)

_Statuses are as of Nov 10 and follow the project’s own labels._

← [The copy map](https://jcody.com/ai-projects/copy-map/)  |  [Field lessons](https://jcody.com/ai-projects/field-lessons/)
→