Three threads I read this week were about the same question: when should an AI agent stop and ask a human? All three answered at the level of the action. Which tool call is risky, which amount needs a signature, which decision the model isn't allowed to make.
The cheapest guardrail I have doesn't live there. It's picking what the thing runs inside.
The renderer that never gets trusted
Part of what I build renders arbitrary HTML in a headless browser. Anyone can hand it a URL or a page of script, and there's no version of that where I trust the renderer to behave. So it doesn't get asked to. It runs sandboxed, with egress rules, resource limits and a hard wall-clock deadline, and a bad render gets killed rather than reasoned with. None of the safety comes from the thing being careful.
The same rule, pointed at my own tooling
