The Principle of Fail-Closed AI
In standard network security, a firewall is fail-closed: if a rule does not explicitly permit a packet, the packet is dropped. In AI agent orchestration, the same principle must apply to tool execution:
- Draft vs Ship Isolation: The LLM is permitted to synthesize, reason, and draft actions inside a sandbox. It has zero network access to production endpoints.
- Receipts: Every proposed state change is recorded with its parameters, so a person can review it.
- Deterministic Gatekeeper: The transition from draft to production requires an explicit human approval.
