AI Agents Engineering · Memory, Eval, Safety & Production · Lesson 3 of 3
Guardrails, the lethal trifecta & shipping
The last mile is making an agent safe and affordable enough to hand to real users. Combine guardrails, human oversight, and cost/latency discipline.
Safety
- Guardrails: input/output filters, allow-lists, schema validation, and refusal checks around the loop.
- Human-in-the-loop: require approval for irreversible/high-impact actions (payments, deletes, external sends).
- Indirect prompt injection: retrieved/tool content can carry instructions — treat it as data, delimit it, never let it silently change the agent's goals.
The lethal trifectaExfiltration risk needs all three: access to private data + exposure to untrusted content + ability to communicate externally. Cut one leg (e.g. no outbound send without approval) and the attack cannot complete.
Production
- Cost & latency: cap steps/tokens, cache, route easy work to smaller models, and prefer workflows for known paths.
- Reliability: retries with idempotency, timeouts, and graceful degradation when a tool fails.
- Deployment: version prompts/tools, roll out behind evals, monitor success/cost/error dashboards, and keep a kill switch.
◆ Lock it in
- Guardrails + human-in-the-loop for irreversible actions; retrieved content is untrusted.
- The lethal trifecta: private data + untrusted content + external comms — cut one leg.
- Ship with cost/latency caps, idempotent retries, versioning, monitoring, and a kill switch.
Feynman drill — say it out loudExplain the lethal trifecta and describe one concrete control that breaks it for a web-browsing, email-sending agent.
Step 1 rate your confidence · Step 2 pick your answer
Which combination defines the 'lethal trifecta' that enables data exfiltration?
Step 1 — how sure are you?