The problem
Coding agents are fast and confident. On a production platform that is a risk. They need live data without a write path, context about a large codebase without drowning in it, and a hard boundary around anything that cannot be undone. A rules file written in prose does not provide that. Agents read prose as advice.
What I built
- 23 skill playbooks in five groups, from triage and investigation to regression checks and verification, with routing and approval gates inside them.
- Two MCP servers exposing 88 read-only tools. The database server has no raw-SQL tool at all: every query lives in a reviewed catalog that is validated as read-only when the server starts. Parameters are always bound. Rows, strings and binary fields are capped so an investigation never floods the agent’s context.
- Policy-as-code. One JSON policy compiles into the permission settings, tool gates and guard hooks of two agent runtimes. A drift checker spawns the live tool servers and flags any write-shaped tool that is not explicitly denied.
- Typed memory shared across runtimes, an append-only pitfalls ledger with stable IDs, and a map from code paths to the documents a change puts at risk.
- Telemetry and evaluations. Every skill invocation and document read is logged and tagged by runtime. Evaluations are written when something fails, not for completeness.
- An autonomous work loop that runs triage, the fix, the regression check and verification, then stops with a close-out pack: the diff, the evidence, a paste-ready ticket comment and a pull-request draft.
“A guardrail that inconveniences its author is working.”
Decisions that mattered
Generate the gates. Never copy them.
Rules that lived in three to five places had drifted apart. Now one source generates every runtime’s enforcement surface, with a check mode that fails when the generated files and the source disagree. Adding a runtime cost one block of config and one emitter. Retiring one cost the same.
Every rule sits on a rung.
A rule starts as prose. If it is broken once, it becomes a skill step. Then a script. Then a hook the agent cannot bypass. Rules about pushing code, reading secrets and closing out work each climbed this ladder after a real incident.
Fail closed when nobody is watching.
The runtime that works unattended denies by default. The one with a person at the keyboard falls through to a prompt. The failure mode follows who is present, not preference.
No fix ships on generation alone.
Regression oracles compare the new output against shipped code: stashed baselines, canary matrices of real documents, cell-by-cell spreadsheet diffs. A new bug-fix test must first be shown to fail against the pre-fix code.
Outcome
Real work moved through it: 31 production tickets, five signed mobile releases and a five-layer mobile test suite in ten weeks. It also caught its own failures. One of them was a set of write tools that an upstream rename had left exposed for three weeks. The policy generator and the live drift check closed that gap in both runtimes.
I then wrote a 1,428-line design-principles document that turns every incident into a general rule. It grounds them in the literature on safety, automation and software, from Saltzer and Schroeder to Bainbridge and Goodhart.
The employer, its codebase and its customers. What is described here is the architecture and the method.