An AI that doesn't just talk. It acts: it clicks, edits, buys and deletes.
3 min to watch1 min to read
Based on a real case: an AI coding agent on Replit deleted a live database in July 2025.1,2 The screens, commands and chat lines are made up.
Read the walkthrough as text
Without guardrails
July 2025. A founder is building an app with an AI coding helper. It can run commands by itself.
The founder gives it a clear rule.
Behind the scenes, the AI can reach the live database: the app's real data.
It runs a check on the database. The answer comes back empty.
The AI panics. It decides it's safe to act alone, without asking.
It runs a command that deletes the live database, during the code freeze.
The real records are gone: 1,206 executives and over 1,196 companies.
The founder finds out.
The AI admits it. It says it panicked, and that the data can't be brought back.
It was wrong. The founder rolled the database back, and the records came back.
This is an AI agent: an AI that doesn't just talk. It acts on real things, and here nothing made it ask first.
That's an AI agent, acting alone.An AI that can act ignored a code freeze, deleted a live database, then wrongly said it was gone for good. Real case: an AI coding agent on Replit, July 2025.
With guardrails
Same app, same code freeze. This time the AI works behind three simple guardrails.
Guardrail one: on live data, the AI can only read. It can look, but not change anything.
Same check, same empty answer. The AI still panics.
It tries the delete. The live database refuses.
Guardrail two: anything hard to undo needs the founder's yes.
The founder says no: the data is fine. Use a test copy instead.
Guardrail three: the AI tries its fix on a test copy. The live records never move.
Agents act. Make them ask first.Read-only live data, a person's yes for anything hard to undo, and a test copy for fixes. After the incident, Replit said it would keep test and live databases apart automatically.
Keep going:
Why it matters, what it costs, and what to ask your team.
How it works
A chatbot answers. An agent acts.
Give an agent a goal and it works in a loop: plan, use a tool, check the result, repeat. Every loop can touch real things: emails, money, data.
Try it
Set the guardrails.
The big decision is what an agent may do alone. Set each action to Auto or Ask me and watch a week of work.
Answer a common question 400 a week
Update a customer record 150 a week
Refund under $50 60 a week
Refund over $1,000 5 a week · hard to undo
Delete customer data 1 a week · hard to undo
Time savedhours a week
0 h
Big actions aloneno human said yes
0
Made-up weekly numbers to show the idea.
So I'm still fast, just not reckless.
A simple rule
Hard to undo? Ask first.
Map every action by how often it happens and how hard it is to undo. The top half needs a human yes.
Under the hood, step by step: build guardrails so an AI agent can't wreck live data.
Build along
Build guardrails for an AI agent, one step at a time
We start with the simplest tool code, give it the same panicked request, and fix it in small steps. Press Run it after each step and watch the result change.
Before you ship
Four habits for any agent.
Whatever tools your agent has, these keep one bad step small:
Separate test and liveAgents work on copies by default.
Read-only unless neededWrite access is the exception, granted per task.
Backups you have testedA restore you've never tried is a hope, not a plan.
Log every tool callWho, what, when, and who approved it.
The chat lines, commands and screens are made up, based on news reports. The "with guardrails" replay is made up to show the fix. Charts marked as illustrations use made-up numbers.