The failures that make the news — an agent inventing a refund policy, agreeing to a price, giving medical advice — are not model failures; they are scope failures. The model did what it was allowed to do because nobody wrote down what it was not allowed to do. Guardrails are that document, made executable.

A written scope

A list of what the agent may discuss and do, and a list of what it may not, with the may-not list longer. Pricing beyond the published list, contractual terms, anything regulated, anything about competitors, anything the knowledge base does not cover. The scope is in the system prompt and it is also checked by a second, cheaper model pass on every response before it is sent.

Escalation triggers

Conditions that end the agent's turn and start a human's: an explicit request for a person, detected frustration, a topic outside scope, a repeated question the agent could not answer, a value above a threshold, a keyword list you maintain. Escalation should be fast and graceful — 'I'll get a colleague; they'll have this conversation in front of them' — and it should actually create the task with the transcript.

Full logging

Every conversation, every tool call the agent made, every escalation, stored with the version of the prompt and the model used. This is what lets you answer 'what did it say to this customer' and 'when did it start doing that'. Logs are also the training set for the next improvement.

The weekly review

Read a sample of conversations, all escalations and every negative rating. Sort findings into: answer it should have known (add to knowledge), thing it should have refused (add to scope), thing it did well (leave alone). Ship the prompt change, note it in the changelog, repeat. An agent that is reviewed weekly gets better; one that is launched and left gets quietly worse as the world changes around it.