I watched an AI agent send 200 emails to the wrong recipients because I forgot one validation check. The emails were well written. The offers were real. The recipients were just... not our leads.
That was early. I learned fast. Every agent I build now has three layers of guardrails before it touches a database or an API. Here's exactly what those layers look like and why they're non-negotiable for production.
Input Validation: Your Prompt Is Not a Schema
The first mistake people make is trusting the LLM to produce valid output. It won't. Not reliably. I've seen GPT-4 return a JSON key called "emial" instead of "email" in a critical pipeline. One typo, and the whole record is garbage.
The fix is a strict validation layer that runs before any data reaches your system. In my AI resume tailor, I use a JSON schema with conditional presence flags. Every field that must be real has a has_* boolean guard. If the LLM tries to fabricate a phone number, the schema rejects it.
const resumeSchema = z.object({
contact: z.object({
email: z.string().email(),
phone: z.string().optional(),
has_phone: z.boolean()
}).refine(data => {
// If phone is present, the guard must be true
return data.phone ? data.has_phone : !data.has_phone
}, "Phone number present but has_phone flag is false")
})
This pattern catches hallucinations before they corrupt your database. The schema is the contract. The LLM is just a suggestion engine.
Permission Scoping: Give Agents the Minimum They Need
An agent should never have write access to tables it doesn't need. That sounds obvious, but I've seen production systems where a job description rewriting agent had full CRUD access to the user table.
When I built the LLM scoring pipeline for a job board platform, I created separate database roles. The scoring agent only had SELECT on the job listings table and INSERT on a scoring results table. It never touched users, applications, or configuration. Even if the prompt was hijacked, the damage was contained.
For a real-time meeting assistant I built, the transcription agent could write to an analysis results table but had no access to user profiles or billing data. A separate service handled the database write after the agent's output passed validation.
The rule: scope permissions to the narrowest possible set. Then scope again. Then test what happens when the agent goes rogue.
Human-in-the-Loop: Destructive Actions Need Approval
Some actions are too dangerous to automate. Deleting records, sending bulk communications, writing to production databases. These need a human in the loop.
In a social media automation tool I built, the agent could generate posts and schedule them, but publishing required a manual approval step. The system showed a preview. The user clicked "Approve" or "Reject". No auto-publish without consent.
The autonomous apply module I'm building for a client uses a swipe interface. The agent finds matching jobs, but the user swipes right to approve each application. The agent never applies without confirmation.
This pattern is simple. It saves you from the "I accidentally sent 5000 emails" panic. It also forces your users to stay engaged with the agent's output rather than blindly trusting it.
Rate Limiting and Cost Controls
AI agents can run up costs fast. An infinite loop calling GPT-4 can burn through your API budget in minutes. I learned this the hard way when the job board's AI rewrite pipeline had to be shut down because costs spiraled.
Now every agent I build has a token budget and a rate limit. The social media tool uses Groq API with load balancing across 16 models, but each model has a per-minute cap. If the cap is hit, the agent pauses and retries later.
For the resume tailor, I use GPT-4o-mini for bulk processing and GPT-4o only for complex tasks. The system tracks token usage per session and alerts me if it exceeds a threshold.
Rate limiting isn't just about cost. It's about stability. An agent that fires 1000 requests per second can bring down your database. A simple circuit breaker pattern prevents that.
Rollback Strategies: Undo What the Agent Did
No matter how many guardrails you have, something will slip through. The question is: can you undo it?
Every agent I build writes to an audit log before making a change. The log captures the original state, the proposed change, and the agent's ID. If something goes wrong, I can replay the log and reverse the actions.
For database operations, I use transactions. The agent's write is wrapped in a transaction that can be rolled back if the change doesn't pass validation. This is standard practice for any production system, but it's often forgotten when building AI features.
The ATS middleware I built for a client used idempotent sync logic. If the same job listing was processed twice, it wouldn't create a duplicate. Safe retry mechanisms meant a failed sync could be replayed without corrupting data.
Idempotency is your best friend. Design every agent operation so it can be safely retried. That way, a rollback is just a replay of the correct state.
Closing
AI agents are powerful. They can automate entire workflows, write content, and engage with users. But they're also unpredictable. Every agent I've deployed has done something I didn't expect.
The guardrails I've described are not optional. They're the difference between a tool that makes your team more productive and a liability that costs you a weekend of firefighting.
If your team is shipping AI features and worrying about what happens when they go rogue, that's the kind of thing I help with. Happy to compare notes.
Written by Abdul Rehman, full-stack AI engineer building production SaaS, MVPs, and AI automation. More at PrimeStrides.
