Why LLM agents need four hard boundaries before they can touch production
Innowise_ · reddit · 2026-07-24
The author argues that an LLM should never have a direct path to production systems and lays out a four-boundary pattern for safer agent architecture: identity, intent, policy/execution, and system-of-record.
- Identity boundary: authenticate the user before the LLM sees the request; trusted code, not the model, supplies userid, tenantid, role, and session metadata.
- Intent boundary: the agent may classify, retrieve context, and propose an action, but only as a strict schema with a risk level.
- Policy/execution boundary: deterministic checks enforce permissions, schema validity, business rules, approval, idempotency, retries, kill switches, and circuit breakers; approvals must match the exact payload.
- System-of-record boundary: the downstream system validates invariants and returns a durable result; the agent saying “done” is not proof the action happened.
The proposed flow is: LLM proposes → policy decides → deterministic code validates → human approves when needed → core system executes → audit log records the result. The post closes by asking what additional controls real systems use.
More from coding & agent
- LLM security tooling looks dramatically better in the Sonnet 4.7+ era — dsp_ · 2026-07-24
- NO8D adds 397 prompt cards and Krea 2 styles to its ComfyUI library pack — Suspicious_Aide2697 · 2026-07-24
- Google and Gemini Notebook workflows are becoming skills, but mostly for reliability and latency — tokumin · 2026-07-24
- Building Profit-Driving Agent APIs is the Current Goldmine — eptwts · 2026-07-24
- Grok Build adds workflows that fan tasks out across hundreds of agents — elonmusk · 2026-07-24
- Blaxel ships Agent Drive, a shared filesystem for AI agents — Scobleizer · 2026-07-24