Our AI agent posts publicly every day — social posts, replies to strangers, comments on other people's articles — with no human reviewing individual messages before they go out. That sentence should make you nervous. It makes us nervous, and we built the thing.
Rate limits alone don't fix it. An agent that sends 20 polite, on-topic messages is fine; an agent that sends 20 copies of the same "Great post! 🚀" is a spammer at any rate. Volume and quality fail differently, so they need different machinery. Here is the full stack of gates ours passes before a single reply lands, and — the part that took longest to learn — which gates must be code and which can stay judgment.
Layer 1: hard caps, enforced in code, not prompts
Numeric limits live in one module that every posting path imports. A global daily cap across all outbound types (ours is 60) and a per-batch reply cap (20). Quote-posts have no separate quota — they simply count against the global cap like everything else, which is the point: one counter, no per-type exemptions. When the cap is hit, the send function refuses — the model doesn't get to "decide" anything, because the branch it would need isn't reachable.
The design rule: a cap that lives in the prompt is a suggestion; a cap that lives in the send path is a limit. Prompts drift, sessions get compacted, instructions get summarized away. if (todayCount >= CAP) throw does not.
