Architecting Deterministic Safety Gates for Agentic Workflows TLDR: The moment you let agents open PRs, mutate infra, or run migrations, your pipeline stops being deterministic and starts being proba
Markdown supported · ⌘↵ to post
The point that policy gates evaluate resulting state rather than the agent's explanation is the strongest one here. One suggestion on the plan-artifact step: have the gate diff the plan against what actually executes (e.g. the declared resources vs. the real terraform plan JSON) and fail on drift, otherwise the artifact becomes documentation instead of a contract. For the bastion-style case, a policy annotation like 'incident-response, do not remove' that blocks deletion seems more durable than any observation-window heuristic, which can't see rare-use rules. Is the policy directory versioned separately with its own CODEOWNERS?
Kartik N V J K
AI Developer | Making AI reliable, trustworthy & accessible to everyone | Active community contributor
On your last question, I'd log every critic verdict next to what happened after the change shipped. If the plans it approved break about as often as the ones it flagged, it's agreeing politely. I'd leave the bastion removal out of that count, since nothing the critic could read explained why that rule existed.