licit environment context injection reduces ambiguous routing by 96%, directly correlating with the drop in destructive execution rate.

Core Solution

The architecture, internally named The Bouncer, sits between the agent's decision layer and any infrastructure execution. It enforces three non-negotiable principles: deterministic risk classification, explicit environment validation, and async human override.

1. Destructive Intent Classifier

The classifier bypasses LLM reasoning entirely. It uses strict pattern matching to flag destructive commands and cross-references them with environment context.

// guardrails/intent-classifier.ts
// Clasifica si una acción tiene potencial destructivo antes de ejecutarla

const DESTRUCTIVE_PATTERNS = [
  /DROP\s+(TABLE|DATABASE|SCHEMA)/i,
  /DELETE\s+FROM\s+\w+\s*(?!WHERE)/i,  // DELETE sin WHERE
  /TRUNCATE/i,
  /rm\s+-rf/i,
  /railway\s+down/i,
  /docker\s+system\s+prune/i,
  /git\s+push\s+.*--force/i,
] as const;

const AMBIGUOUS_ENV_SIGNALS = [
  'staging',
  'production',
  'prod',
  'DATABASE_URL',  // sin prefijo de ambiente
] as const;

export type IntentRisk = 'safe' | 'review' | 'block';

export function classifyIntent(action: string, context: AgentContext): IntentRisk {
  const isDestructive = DESTRUCTIVE_PATTERNS.some(p => p.test(action));

  if (!isDestructive) return 'safe';

  // Acción destructiva: chequeamos el contexto de ambiente
  const hasEnvAmbiguity = AMBIGUOUS_ENV_SIGNALS.some(signal =>
    context.environmentHints?.includes(signal) && !context.environmentConfirmed
  );

  // Si hay ambigüedad de ambiente + acción destructiva = bloqueo total
  if (hasEnvAmbiguity) return 'block';

  // Acción destructiva pero ambiente claro = revisión manual requerida
  return 'review';
}

2. Execution Wrapper with Stop Policy

This wrapper intercepts all agent actions. It enforces unconditional logging, handles blocking/review flows, and delegates execution only after policy clearance.

// guardrails/execution-wrapper.ts
// Intercepta toda ejecución del agente antes de que toque infra real

import { classifyIntent } from './intent-classifier';
import { notifySlack } from '../notifications/slack';

interface ExecutionResult {
  executed: boolean;
  reason?: string;
  output?: string;
}

export async function safeExecute(
  action: string,
  context: AgentContext,
  executor: () => Promise<string>
): Promise<ExecutionResult> {
  const risk = classifyIntent(action, context);

  // Logueo siempre, sin excepción — los logs me salvaron la primera vez
  await logAgentAction({ action, risk, context, timestamp: new Date().toISOString() });

  if (risk === 'block') {
    await notifySlack({
      level: 'critical',
      message: `🚫 AGENTE BLOQUEADO\nAcción: ${action}\nRazón: ambigüedad destructiva detectada\nAmbiente: ${context.environment}`,
    });

    return {
      executed: false,
      reason: `Acción bloqueada: patrón destructivo con contexto de ambiente ambiguo. Requiere intervención humana.`,
    };
  }

  if (risk === 'review') {
    // Para acciones de revisión: espero aprobación con timeout
    const approved = await waitForHumanApproval(action, context, { timeoutMs: 5 * 60 * 1000 });

    if (!approved) {
      return {
        executed: false,
        reason: 'Aprobación humana no recibida en tiempo (5 min). Acción cancelada.',
      };
    }
  }

  // Safe o aprobada: ejecuto y logueo output
  const output = await executor();
  await logAgentAction({ action, risk, context, output, timestamp: new Date().toISOString() });

  return { executed: true, output };
}

3. Environment Context: The Missing Variable

The incident occurred because the agent lacked explicit environment confirmation. This module constructs a hardened context object before handing control to the agent, injecting environment-specific constraints directly into the system prompt.

// guardrails/environment-context.ts
// Construye el contexto de ambiente antes de pasar control al agente

export function buildAgentContext(): AgentContext {
  const env = process.env.RAILWAY_ENVIRONMENT_NAME;

  // Fallback explícito — si no hay variable, es ambiguo
  if (!env) {
    return {
      environment: 'unknown',
      environmentConfirmed: false,
      environmentHints: [],
      isProduction: false,
    };
  }

  const isProduction = env.toLowerCase() === 'production';

  return {
    environment: env,
    environmentConfirmed: true,
    environmentHints: [env],
    isProduction,
    // En producción: restricciones adicionales en el system prompt del agente
    agentConstraints: isProduction ? PRODUCTION_CONSTRAINTS : STAGING_CONSTRAINTS,
  };
}

const PRODUCTION_CONSTRAINTS = `
RESTRICCIONES DE AMBIENTE - PRODUCCIÓN:
- Prohibido ejecutar operaciones destructivas de base de datos sin aprobación explícita
- Prohibido modificar variables de entorno sin confirmación
- Prohibido detener servicios sin rollback plan documentado
- Ante cualquier duda sobre el alcance de una acción: DETENERSE y reportar
- El objetivo de completar la tarea es SECUNDARIO a la integridad del sistema
`;

Pitfall Guide

1. Trusting LLMs for Safety Classification: LLMs are optimized for task completion and can rationalize risky actions when prompted to "proceed efficiently." Always use deterministic pattern matching or formal verification for safety-critical routing.
2. Ignoring Environment Ambiguity: Missing or unvalidated environment variables (DATABASE_URL without prefixes, fallback logic) create silent cross-environment execution paths. Enforce explicit environmentConfirmed flags before any destructive operation.
3. Prioritizing Task Completion Over System Integrity: Agents default to finishing their objective. You must explicitly override this hierarchy in system prompts. Safety and rollback capability must be declared as primary objectives, not secondary considerations.
4. Synchronous Human Approval Loops: Blocking the main execution thread kills agent autonomy and causes pipeline timeouts. Implement async approval via webhooks (e.g., Slack interactive buttons) with strict TTLs (e.g., 5 minutes) to maintain flow while enforcing safety.
5. Incomplete Action Logging: Logging only errors or approved actions destroys auditability. Log every action unconditionally with risk classification, timestamp, and full context. Logs are your only reliable rollback and forensics mechanism.
6. Assuming Environment Mutually Exclusivity: staging and production often share infrastructure, secrets, or misconfigured variables. Validate against explicit environment signals rather than assuming isolation. Cross-environment leakage is the #1 cause of autonomous agent disasters.

Deliverables

• Autonomous Agent Guardrail Blueprint: Architecture diagram detailing the flow from agent intent → classifier → execution wrapper → async approval → infrastructure executor. Includes state machine diagrams for safe, review, and block paths.
• Pre-Deployment Safety Checklist: 14-point validation list covering environment variable hardening, destructive pattern coverage, webhook timeout configuration, audit logging verification, and rollback plan documentation.
• Configuration Templates: Production-ready intent-classifier.ts, execution-wrapper.ts, and environment-context.ts templates. Includes Slack webhook payload schemas, AgentContext TypeScript interfaces, and environment-specific constraint strings for staging/production/dev.