HHlinor Request a Risk Review
Engineering notes

Using our own agent-governance stack in a real business workflow

Hlinor — engineering notes. October 2026.

For a long time, the components that govern AI agents were validated the usual way: synthetic demos, unit tests, polished example repositories. That proves the code works. It does not prove the components hold up when real email, real obligations, and real consequences flow through them.

So we changed the order: we started running our own agent-governance components inside a real business workflow, rather than validating them only against synthetic demos. Each component now carries a different, honest kind of proof.

Registry — the authorization boundary, proven in production

Registry (open source, Apache-2.0) is the policy layer every consequential agent operation must pass: scoped allowlists, explicit approval requirements, fail-closed on anything unknown.

Its proof comes in two distinct levels. The public reproducible proof is in the repository: the same policy semantics we run in production, executable policy examples, and a 599-test suite anyone can run. The production evidence is the real mail workflow: owner-bound send approvals pinned to one draft revision and its exact content digest, single-use and consumed atomically with a durable dispatch record, exactly-once delivery with replay protection, per-decision provenance in the audit trail, and a full control-plane scan that found no critical or high issues.

The production story is documented in our Mail Hub case study, including the Controlled Send acceptance section added after this article was drafted.

ScopeGuard — communication intake and replay, proven live

ScopeGuard compares communication against agreed scope. Its public core runs the same deterministic analysis engine we use internally, and the positive scope-drift behavior is separately reproducible from the repository.

What production added is the intake path: live, provider-neutral communication events flowed through a review-only pilot — import and replay verified, zero external writes. We report that pilot honestly as a negative result: it proved intake and replay, not detection, because no scope agreement was in place for the messages involved.

SheetSentry — spreadsheet auditing with failure isolation

SheetSentry audits XLSX attachments in an isolated, network-disabled processor. The production chain, observed end to end: real incoming workbooks → deterministic analysis → 19 persisted findings → replay-safe → and when the processor was deliberately crashed, mail ingestion continued without a hitch. Findings are structural, carry stable IDs and cell evidence, and wait for human review — a warning is never a claim about business correctness.

What "verified" means — and what it does not

  • Every consequential operation is authorized per request against a signed policy bundle; outbound send additionally requires a human approval bound to one exact draft revision and content digest.
  • Exactly-once is enforced structurally: durable dispatch claims, single-use approvals, replay that returns records instead of repeating actions.
  • When our production verification exposed a Sent-folder reconciliation edge case before rollout expanded, the system preserved exactly-once delivery throughout; the edge case was fixed with regression tests and the flow was revalidated end to end.
  • No detection-accuracy percentages. No "the agent decides what to send". No autonomous retries. Findings are not authorizations, and authorizations are never blanket.

Components

All engineering notes