Operational category
Governance
Where humans hold the line.
HITL Gate
Pause before anything irreversible.
Critical steps are reviewed and approved by a human before execution. The system suspends, persists state, poses a structured question, and resumes once the human replies. Best framed as graduated autonomy — oversight set per action class by stakes (full automation for low-stakes, supervised for moderate, human-led for high-stakes) rather than a single on/off gate.
Trade-off Higher control is achieved against slower operational workflows.
Sandbox Execution
Run code where it can't escape.
Model-generated or agent-selected code runs in an isolated environment — a container, a microVM (e.g. Firecracker), or a hosted code sandbox — with no access to the host filesystem, network, or credentials beyond what the task explicitly needs.
Trade-off Secure execution is achieved against infrastructure and performance overhead.
Audit Trail
Every step, signed and timestamped.
Decisions, tool calls, inputs, outputs, and approvals are written to an append-only, tamper-evident record, so every action a run took can be reconstructed and attributed after the fact.
Trade-off Traceability is achieved against privacy, storage, and governance overhead.
Output Validation / Schema Enforcement
Reject malformed model output before it pollutes the next step.
Model responses are validated against schemas, types, or business rules before use, and a failed check triggers a reject-and-re-prompt loop rather than letting the malformed output flow downstream.
Trade-off Higher reliability is gained against restrictions on expressive freedom.
Least Privilege Agent
Each agent sees the smallest world that lets it do its job.
Each agent receives only the tools, data, and permissions its specific task requires — the principle of least privilege applied to agents, so a compromised or misdirected agent can reach only its own blast radius rather than the whole system.
Trade-off A reduced attack surface is gained against higher role and permission management effort.
Controller
Polices the agent's actions against policy as the run unfolds.
Continuously monitors the behaviour of the agent and transparently aligns it with ethical principles and compliance rules. Realised at scale as a governance agent (watching for policy violations) or security agent (flagging anomalous behaviour) supervising other agents, escalating to a human only on a trip.
Trade-off Stricter compliance is gained at the expense of operational overhead and complex rule definitions.
Integrator
Sanitise the percepts before reasoning touches them.
A validation pattern — a dedicated gate that validates all incoming information for quality and consistency before it ever reaches the model.
Trade-off Higher data consistency is gained against additional latency during perception processing.
Multimodal Guardrails
Per-modality filters on every input and output the agent touches.
Text, image, audio, or video inputs and outputs are screened by modality-specific safety classifiers on the way in and on the way out, since a text-only filter is blind to harmful content encoded in other modalities.
Trade-off Better security in media flows is gained against additional latency and false classifications.
Statistical Guardrails
Reject on the numbers: cosine-distance drift and token-entropy confidence.
Quantitative, model-agnostic checks sit between a non-deterministic agent and the user and reject outputs on statistical signals rather than schema or rules: semantic-drift detection (cosine-distance z-score from a safe baseline) and confidence gating (Shannon entropy of token probabilities).
Trade-off A cheap, model-agnostic safety net is gained against threshold-tuning effort and false positives — a novel-but-correct answer can read as drift, and a confidently-wrong answer can pass the entropy gate.
Where to next