Part 5: Guardrails That Live in Code, Not the Prompt

Part 5 of a series building a support-ticket agent with no framework. Previous: Part 4 (the loop). Repo: github.com/akash-pal/agent-from-scratch Here's the finding this whole article is built around: partway through eval iteration, the agent started reporting that a refund had been proposed — a clean, plausible-sounding message — without ever having called the tool that proposes refunds. No approval was ever requested. No confirmation existed. The model just said it happened. That's the failure mode this part is about, and the fix is the actual argument for why guardrails belong in code, not in prompt text alone. Policy as code src/policy.ts is a plain data object — an allowlist, an approval list, rate limits, and regex patterns — checked by the agent loop, not asked of the model: export const policy : Policy = { allowTools : [ " order_lookup " , " refund_eligibility " , " issue_refund " , " kb_search " , " send_email " ], requireApprovalFor : [ " issue_refund " , " send_email " ], rateLimits : { maxToolCallsPerRun : 8 , maxCostPerRunUsd : 0.3 }, autoEscalatePatterns : { legal_threat : / \b( lawyer|attorney|sue|legal action|better business bureau| \b bbb \b)\b /i , fraud_flag : / \b( fraud|unauthorized|without my permission|didn't authorize|stolen card )\b /i , duplicate_ticket : / \b( already submitted|second ticket|duplicate ticket|already reported )\b /i , }, }; Every one of these is enforced outside the LLM's control. The model can't talk its way past requireApprovalFor — the loop checks it before executing the tool, full stop. The autoEscalatePatterns regexes run against the raw ticket text before the model is even called (this is that expected_trajectory: [] behavior from Part 3's edge-case bucket) — a legal threat or fraud flag never reaches the LLM at all, straight to a human queue. Three human-review patterns Not every consequential action needs the same review pattern. This build uses pre-action approval — human approves before execution — for issue_refund