How I build agents

Controls first, then the model. Before I decide where a model runs, I decide where a person approves, what gets logged, how the agent stops, and where your data goes. These are the principles I design for. I describe patterns here and leave out the configuration behind them.

Autonomy tiers

I give each agent a fixed level of autonomy, and it cannot promote itself to a higher one.

• Read-only. The agent reads and triages, and it never sends anything.
• Draft and approve. The agent writes the draft; a person sends it or applies it.
• Act, with human approval on anything public or irreversible.
• Built but switched off. Some capabilities exist in the code and stay gated until you approve them.

The agent itself holds no credentials. Actions that need them run in a separate, narrow service outside the agent, so the agent cannot do the forbidden thing even if someone tells it to. Safety lives in the structure, where a prompt cannot override it.

Human approval points

A person approves before anything goes public or cannot be undone. An agent team cannot grow without a human approving it first. Every agent has an escalation path that flags a conversation to a person instead of guessing its way through.

Audit logging

I record every production change with its before and after values and a path to roll it back, with secrets redacted from the log. Suspicious inputs get logged, not acted on.

Kill switch and rollback

You can stop the agent at any time.

I take a backup before every change and deploy workflows with that backup in place, never by hand. During maintenance windows, a watchdog rolls the code back automatically if something goes wrong. It never touches the database, and it leaves a receipt of what it did.

Evals

I benchmark prompts and skills against a baseline instead of asserting that they work. I publish failures next to the wins, root-cause them and fix them. A null result goes out as a null result. Before release, the system goes through a red team, and I fix every finding.

These controls reduce risk. They do not guarantee anything.

Where your data goes

Three options keep the model on your side. One puts it on mine.

• Local model. It runs on hardware you control, and prompts do not leave that hardware.
• Your own Codex subscription. You contract with the model provider directly, in your own name.
• OpenRouter with zero data retention. I use only routes that do not retain prompts.
• An agent I host. My company, Evolve 47 AB, is the processor under Article 28 of the GDPR.

Security contact

If you find a weakness in something I built, write to hello@byronfabrizio.com. How this website itself handles your data is on the privacy page.

Next step

If this is how you want your agents built, work with me. Forward this page to your IT or compliance reviewer first if that helps.