Agentic foundations · August 30, 2026 · 5 min read
From chatbot to operator: designing AI that takes safe actions
The gap between a demo and a product is safety. Here's the pattern we use to let an AI change real data — typed tools, server-side validation, and an approval gate — so it's capable without being reckless.
Most AI features stop at generating text, because text is safe — if it's wrong, a human just ignores it. The moment an AI can write to your database or post to your channels, “wrong” has a cost. The engineering job is to keep the capability while removing the recklessness.
Rule 1: the model proposes, the server disposes
In our agentic work OS, the model never runs SQL. It emits a typed tool call — create_tasks, update_tasks — and the server validates every field against a schema before a single row is written. The model's output is a request, not a command. Your backend is the authority that decides whether the request is allowed.
Rule 2: inject live context every turn
An agent acting on a stale snapshot makes confident, wrong decisions. So before each turn we inject the current state — the live board, the current draft, the connected accounts — into the model's context. It acts on reality, not on what was true when the conversation started.
Rule 3: gate the irreversible
Reversible actions (create a draft, reschedule a task) can run freely. Irreversible ones (publish, send, spend) pass through a confirmation. In the marketing dashboard, agents draft complete campaigns automatically, but every external publish waits behind a human approval gate and runs through encrypted OAuth. The system does real work all day; it just never does the one thing you can't take back without you.