Safety is engineering, not adjectives.
The risks worth planning for are concrete: prompt injection, data exfiltration, over-permissioned agents and hallucinated actions. A better system prompt fixes none of them. Controls in code do.
Every harness we build
Permissions
Tool permissions per agent, not per platform. A research agent gets search and read, and the default is deny.
Scoped credentials
Short-lived, least-privilege tokens injected at call time. The agent never holds a secret it doesn't need.
Approvals
Sends, payments, deletes and anything external pause for a human, who sees the exact payload, not a summary.
Audit log
Every tool call, its arguments, its result and who approved what. Any run can be replayed.
Sandbox
Code execution and browsing run in isolated environments with no path to production by default.
Undo
Drafts over sends. Soft deletes over hard deletes. Branches over main. One-click rollback.
Default deny. Read-only first.
Every agent starts read-only. It can look around, read code, inspect data and explain what it sees. A human unlocks writes one system at a time. Being trusted with one system doesn't make an agent trusted with another.
- Blast radius stays small. A bad assumption from a read-only agent is a wrong sentence, not an incident.
- Trust is earned on evidence. A human watches how the agent reasons about a system before writes are enabled.
- Consequences, not buttons. Rules like “never trigger outbound contact” hold up when the UI changes.
Automate the boring, gate the irreversible.
Four questions for every action.
Is it reversible?
Drafts and internal notes are cheap to undo. Sends, payments, deletions and public posts are not.
Does it leave the building?
Anything external carries reputational and legal weight that internal actions don't.
What's the blast radius?
One record or a bulk update. One recipient or a whole list.
How verifiable is it?
If code can check correctness, autonomy goes up. If only judgment can, it goes down.
Design for containment.
Trusted instructions and untrusted data end up in the same context. So everything that didn't come from the user or the system is treated as data.
- Fence untrusted content. Mark where it came from; nothing inside the fence is an instruction.
- Enforce in code. The harness decides which tools can run once untrusted content is in context.
- Watch the sinks. Lock down outbound channels first: email, messages, URLs and rendered images.
- Break the trifecta. An agent that reads untrusted content doesn't also get an unrestricted outbound channel.
Selective, case by case, startups through enterprise.
We take on a limited number of engagements at a time so every build gets real engineering attention and is made for your business, not pulled from a template.
Apply
A short application through this site.
Personal review
Every application is reviewed personally.
Scope
Where is time lost, and can a system take it over safely?
Build
Read-only first, with approvals, logs, sandbox and undo.
Operate
Writes are earned one system at a time.
Every engagement starts with an application.
We take on a limited number of engagements at a time and review every application personally, case by case, whatever the size of the company. If it's a fit, we'll reach out to scope the work together.