AI Safety
Keep the human on the decision.
Safety, for me, is not a policy document. It is the set of rules a system cannot break even when the model wants to be helpful. These are mine, and the systems they came from.
The rules
1. AI recommends. People decide.
An agent can draft, score, and propose. A person owns the decision, and the system records who owned it. Every outbound action in my agents, an email, a payment, a booking, passes through an approval ladder before it leaves the building.
2. Unmeasured is null. Never zero. Never a mean.
A score with no observations behind it is a lie with a number on it. My code bases carry a standing no-fabrication rule: no default success rates, no provisional grades, no invented confidence. If the system has not watched an agent, it says so.
3. Safety lives in the harness, not the prompt.
Prompts are suggestions. Harnesses are law. Staging before commit, server-issued ids, caps on the state an action can produce, serialized writes per session, and regulated copy written by the server rather than the model.
4. One model, one loop.
Every extra agent in a chain is a place where accountability leaks. I run one model in one loop with tools, and I add a second agent only when I can name what it is for and who checks it.
5. Measure the agent, then believe it.
Every agent I ship has an eval suite: cases with a schema, code graders for the hard facts, a model judge for the soft ones, a recorded baseline, and replay so a regression shows up as a diff, not a surprise.
6. Audit yourself like an adversary.
In 2026 I commissioned read-only audits of my own platform with one question: can it defend its numbers to an underwriter, an auditor, or a regulator? The honest answer was no, cited by file and line. Rules 2 and 3 are what I built from that report. The findings, with code: The score that lied by default.
Where the rules run
Outreach
Email agent
Works a real business mailbox: drafts, triages, and books, but sends only after a person approves, with an instant hand-to-human on any thread. Without credentials it does nothing at all.
Commerce agents
Merchant agent harness
A Python harness over Anthropic's reference commerce agents: caps, audit chain, approval, stores, a hold on travel bookings. Eval suite with code graders, a judge, baseline, and replay.
Office agents
Voice and chief of staff
A voice agent that answers the phone for a business and hands off when it should. A chief-of-staff agent on the Claude Agent SDK with a guard hook before every tool call and an audit hook after it.
Practice
Daily work in Claude Code
I build with Claude every day, with house rules the agent must follow: no fabricated numbers, no floating-point money, confirm before anything leaves the building, cite file and line for every claim about code.
What I want to work on
The gap between what an agent did and what anyone can prove it did.
I spent twenty years launching products inside regulated financial institutions, where nothing reached a customer until it could explain itself to a risk committee. Agents deserve that bar. Most do not meet it yet.
The problems I care about: honest self-report under pressure to be helpful, oversight that scales past one human per agent, evals that survive contact with real money, and controls a careful institution can inspect and sign.