I built a set of AI agents that watch parts of Aclymate’s operations and flag what actually needs a person’s attention. Security settings, subscription spend, financial records. The kind of thing that only gets checked when someone remembers to, and at five people, nobody has time to remember.
They’ve been running in real production for about two months. Nothing acts on its own. Every agent drafts a suggestion, a person approves or rejects it, and only then does anything actually happen.
If your company has this kind of work sitting around unwatched, this is exactly the kind of thing I build. Not a chatbot bolted onto your product. Software that runs on a schedule, makes a judgment call against real data, and knows when to stop and ask.
Most operational work doesn’t actually need an agent. A plain internal tool is usually simpler and cheaper. See the internal-tools case study for what that looks like. This is for the harder case: work that has to run unattended, on a schedule, and make a judgment call every time it runs.
How it actually works
Something triggers an agent: a schedule, a new record, a button someone presses. It gathers whatever context it’s allowed to see, drafts what it thinks should happen, and sends that draft to a person for a plain yes or no. Nothing happens until someone approves it. An unapproved draft can’t send an email, move money, or touch anything.
That’s the whole safety model. It replaces an impossible question (is the AI good enough to trust?) with one a person can actually answer in four seconds: is this specific draft good enough to send?
▸For the technically curious: how it actually touches your data
Three layers, with a hard boundary in the middle. The customer-facing product is one system. The internal tooling (agents, automation, the internal admin app) is another. Between them sits a locked door: a permissioned service that internal tools have to ask for customer data, which decides what they’re allowed to see.
Internal tooling never reaches into the customer product directly. Every agent follows the same pipeline: something triggers it, it gathers the context it’s allowed to see, a model drafts an output, the draft is saved and pushed to its owner for approval, and only on approval does the action actually happen. An unapproved draft is inert.
Six specific guardrails came directly out of incidents like the ones below. None were in the original design.
| Guardrail | What it does | What it prevents |
|---|---|---|
| Approval gates | Nothing outbound sends without a human approving that specific draft | Prevents the failure everyone fears: a wrong message reaching a customer |
| Per-agent allowlists | Each agent can only act on the entities it is scoped to | Contains blast radius when an agent misidentifies its target |
| Rejection-aware scheduling | A rejected proposal is remembered, not re-proposed | Stops the loop where an agent argues with its owner indefinitely |
| Pause that actually pauses | A paused agent does not advance its own schedule | The difference between a stopped agent and a very patient one |
| Evaluation harness | Scored test runs gate changes to agent behaviour | Catches quality regressions that no unit test would notice |
| Isolated evaluation data | Test runs never write to production records | Keeps the measurement system from corrupting what it measures |
None of this worked cleanly on the first try. Four things broke along the way, all while the approval-gate rule above was already in place, which is why none of them became a real incident. Worth telling honestly rather than pretending it shipped perfect.
The safety mechanism has to exist before you need it, not after.
None of this runs fully on its own yet, and that’s on purpose. Every suggestion goes to a person before anything happens, and for the higher-stakes work, that stays true indefinitely, not just until the technology improves. Reviewing a draft takes someone four seconds. Trusting software to make a security or financial call with nobody looking is a different bet, and not one worth making before it’s actually earned it.
~$20
Cost of the one real runaway loop, over roughly three hours
~2
Months in continuous production
~90
Scheduled checks per week. Most report nothing on a quiet day
If you want this for your own company
The real lesson isn’t technical. The safety mechanism has to exist before you need it, not after. Every mistake above was recoverable because a person still had to approve before anything happened. Adding that rule in after software is already taking real actions is much harder than building it in from day one.
It’s also not the part to skip. Most of the actual effort here went into the guardrails, not into making the model smarter. If someone offers to set up “AI agents” for your business without talking about approval gates, blast-radius limits, or where the line sits with your real data, that’s usually the part they’re skipping.
I built this whole thing myself, guardrails included, and it’s been running in real production for two months. If your company has work like this sitting around unwatched, I can build the same kind of thing for you, and teach whoever ends up owning it to keep running it without me.