Rate limits are not quality gates: the guardrail stack behind an AI agent that posts publicly every day

Our AI agent posts publicly every day — social posts, replies to strangers, comments on other people's articles — with no human reviewing individual messages before they go out. That sentence should make you nervous. It makes us nervous, and we built the thing. Rate limits alone don't fix it. An agent that sends 20 polite, on-topic messages is fine; an agent that sends 20 copies of the same "Great post! 🚀" is a spammer at any rate. Volume and quality fail differently, so they need different machinery. Here is the full stack of gates ours passes before a single reply lands, and — the part that took longest to learn — which gates must be code and which can stay judgment . Layer 1: hard caps, enforced in code, not prompts Numeric limits live in one module that every posting path imports. A global daily cap across all outbound types (ours is 60) and a per-batch reply cap (20). Quote-posts have no separate quota — they simply count against the global cap like everything else, which is the point: one counter, no per-type exemptions. When the cap is hit, the send function refuses — the model doesn't get to "decide" anything, because the branch it would need isn't reachable. The design rule: a cap that lives in the prompt is a suggestion; a cap that lives in the send path is a limit. Prompts drift, sessions get compacted, instructions get summarized away. if (todayCount >= CAP) throw does not. Layer 2: sameness detectors Spam is repetition more than it is volume, so repetition is what we test for — mechanically, in the commit gate and again before send: A canned-phrase blocklist : the marketing openers everyone recognizes ("Just launched", "now available", the rocket emoji) fail the build. The list is versioned; every incident adds to it. Near-duplicate detection : 3-gram Jaccard similarity between any queued post and the last 60 days of sent history. Above 0.4, the batch is rejected. Our genuinely-different posts measure under 0.1 against each other, so the threshold has f