Guard-rails & control

The question that decides whether agents get used in a company is not "can it do this?" but "what happens when it gets it wrong?". covey answers with three things: enforced boundaries, approvals in the right places, and a recording that holds up afterwards.

Why not in the prompt

"You must not delete customer data" in the prompt is a request. It helps in the normal case and fails exactly when it matters: on an unusual phrasing, on text from a ticket that reads like an instruction, on a change of model.

Guard-rails therefore sit outside the runtime. The agent cannot read them, talk them round or bypass them — all it notices is that an action was refused. In case of doubt it is refused, not let through.

The three places it applies

• Secrets broker — which access, at which scope, for which run. A token that never enters the sandbox cannot be carried out of it.
• Egress — where the sandbox may talk at all. With the docker provider a proxy sits between agent and internet and enforces the allowlist — by default, unless an operator sets COVEY_EGRESS_ENFORCE=false. Hard network isolation (COVEY_EGRESS_ISOLATION=network) takes away the way around it.
• Action layer — which action is allowed, which needs an approval, which is forbidden. Rules apply globally, per department or per agent.

Approvals

Critical actions stop and wait for a human. The defaults after installation show the pattern: an outbound reply to a customer needs an approval, HR systems are off limits, anything called delete is hard-denied.

Meanwhile the agent sits in blocked — it waits without consuming compute and continues as soon as the approval arrives.

Recording

Every run is written down: tool calls with arguments, target-system actions, approvals with the person who decided, screenshots for browser work, plus tokens and cost per model. This is the part audit and data protection want to see — and the part that lets you understand a misstep afterwards.

Kill switch

One switch stops an agent. A second stops the organisation's entire workforce. Both take effect immediately and running sandboxes are torn down. It is the answer to the question that comes up in every security review: "And if we have to stop all of this?"

Cost as a boundary

A budget per agent is a guard-rail too — the one against the mistake that hurts nobody except the invoice. Once it is used up, the agent stops working.

Next

• Identity & secrets — how access is brokered
• Operations & deployment — egress enforcement and hard isolation
• Target systems & plugins — which actions exist in the first place