7 guards that made our agents boring enough to trust

we kept fixing agent failures with better prompts. most of the fixes that survived ended up as plain code around the model instead. these are the guards i now look for: minimum time / evidence before irreversible tools a voice agent cannot end a call before the caller speaks. a payment agent cannot submit before it has the final total. proposal != execution the model proposes the tool call. deterministic code checks amount, recipient, permissions, and current state. one owner for mutable state five agents can read a record. one system gets to write the status field. receipts after every write don't trust a 200. read back the object, message, event, or comment and confirm it is actually visible. idempotency before retries after a timeout, check whether the first write landed. blind retry is how you get duplicate emails and orders. expiry on temporary context "blocked on x" needs a close condition or ttl. otherwise old state keeps leaking into future runs. human approval at the real boundary review the exact recipient + words together. for code, separate who writes the change from who approves production. none of this makes the model smarter. it makes model mistakes cheaper and visible. what guard caught a failure for you that prompting never fixed?