AI agent guardrails: what actually stops an agent doing something wrong?

Every AI model sometimes makes things up. Guardrails make that stop mattering, because a wrong answer can't become a wrong action without passing a checkpoint.

Why can't you just make the model more accurate?

This is where most teams start, and it's the wrong place to start.

Better instructions, more background information, a bigger model: all of that improves accuracy. None of it makes accuracy a safety measure. You would be building a system whose safety depends on a part that is right most of the time by design, and only most of the time.

"Most of the time" is fine for a draft. It is not fine for an email to a customer, a change to your CRM, or a payment.

The better question is not how do we make it right? but what happens if it's wrong?

• If the answer is "someone notices and fixes it," let it run.
• If the answer is "a customer receives something embarrassing," a person needs to approve it first.

What are the four guardrails that actually matter?

1. The agent can only use the tools you have approved

An agent can't do just anything. It has a specific list of things it is allowed to do, and you approve that list.

If it has never been given the ability to delete records, no amount of confused reasoning can delete a record. The ability simply isn't there.

This sounds obvious, and it gets skipped all the time, because it's faster to give an agent wide access during the build and forget to narrow it down afterwards.

2. A person approves anything that can't be undone

For anything customer-facing, the workflow stops and waits. The agent drafts, a person reads it and approves.

In practice this is often an approval step in Slack or a similar chat tool. The draft appears where the team already works, so approving takes seconds and nobody has to log into another system. The Humanoid.Guide weekly newsletter works this way: the draft waits for a one-click approval before it sends.

Teams often object to this because it feels like it cancels out the time saved. It doesn't. The expensive part of most tasks isn't the approval; it's the research, the drafting, the looking things up, the formatting. Cutting that from twenty minutes to twenty seconds is the win. Reading the result before it goes out costs almost nothing.

3. The agent checks its own work first

Before a person sees it, a separate checking step compares the result against the rules for that task. This catches the obvious mistakes, like the wrong format, a missing field, or a claim that contradicts the source, so the person's time goes on judgement rather than proofreading.

This catches some mistakes, not all of them. An AI checking an AI can miss things. It means less reaches the person, but it doesn't replace them.

4. Shadow mode before anything real

Before a workflow is allowed to act, it runs alongside the existing process without acting. Every decision it would have made is recorded. Nobody is affected.

Then you read those decisions, over a real week of real inputs.

This is where you find what nobody expected: the rare case nobody mentioned during planning, the badly filled-in customer record, the one type of request that needs a person every time.

A week of shadow mode tells you more about whether an agent is safe than any amount of testing against sample data. Your real data is messier than your sample data. It always is.

What should "human in the loop" actually mean?

The phrase means a person checks the AI's work before it counts. It gets used so loosely that it often means very little. Some teams use it for a system where a person could step in, in theory, if they happened to be watching.

A useful version answers three specific questions:

That last row matters more than it looks. Plenty of "approval" systems quietly send anyway if nobody clicks within an hour. That isn't an approval step. It's a delay.

What's the failure nobody plans for?

The failure people imagine is dramatic: the agent does something wild and wrong on day one.

The real one is slower. The workflow runs fine for two months. Then a connected app renames a field, or the volume of incoming work changes, or a supplier changes their file format. The agent keeps running, producing results that are slightly wrong, and because it was working, nobody is checking.

Failed runs send an alert, so outright failures show up straight away. Slow, silent decline is harder to spot, and it's the reason ongoing monitoring exists rather than a one-off handover.

Four questions to ask any AI automation vendor

1. What exactly can the agent do, and who approved that list?
2. Where does a person have to approve before something that can't be undone happens?
3. What happens if nobody approves?
4. How will I know in month three that it's still working correctly?

If the answers are vague, the guardrails are vague. Wiodo agrees the approval steps with you during setup. The plans are on the pricing page, and what you keep if you leave covers the exit.

Frequently asked questions

Can you stop an AI agent from hallucinating?

No. Every AI model can produce confident, wrong output. Guardrails don't stop that from happening. They stop a wrong answer from becoming an action, by requiring approval before anything that can't be undone.

What is shadow mode?

Running a workflow alongside the existing process without letting it act. Every decision is recorded and reviewed, but nothing reaches a customer or changes a system. It shows up the rare cases that testing on sample data misses.

Does having a person approve things slow the workflow down?

Only slightly. The time in a process goes on research, drafting and looking things up, not on reading a finished draft. Approval usually takes seconds, against a task that took twenty minutes by hand.

What if the agent is wrong and the human approves it anyway?

That's a real risk, and it's why what the reviewer sees matters. If the review screen shows enough background to make a real decision, people actually review. If it shows a wall of raw data, people click approve without reading.

Can an AI agent check its own work?

Partly. A separate checking step catches format errors, missing fields and claims that contradict the source. It means less reaches the person, but an AI checking an AI can miss things. It catches some mistakes, not all of them.