Guardrails, not prompts: running production software built by agents

I'm the only engineer on Neuday, the platform Norm Bitkisel runs its customer service, marketplace operations and marketing on. It has passed seven thousand commits and half a million lines of TypeScript since February. Coding agents wrote most of those lines.

People ask about prompts. Prompts matter less than you'd think. What decides whether agent-written code is safe to run a business on is everything around the agent: what it can't do, and what has to be true before its work ships.

Make the rules executable

Agents follow written instructions well and forget them under pressure, the same way people do. So every rule that matters is also a check that fails the build:

• Every endpoint declares its access class — public, authenticated, permission-scoped, cron, webhook or internal-HMAC — in a route contract. A new route without one doesn't compile into a release.
• Architecture boundaries are enforced, not described. Modules can't reach into each other's internals; a dependency rule says so and the build checks it.
• Escape hatches are banned: no any, no ignored type errors, no file over a thousand lines. Agents reach for these when stuck; the gate forces them back to the actual problem.
• Secrets are scanned across git history, not just the working tree.

About twenty-seven of these run on every build, alongside roughly 2,400 tests and a visual-regression suite that renders the design system in both themes.

Deny by default at the edges

The scariest failure isn't a crash. It's an agent's test run quietly updating stock on a live Shopify store. External writes go through a manifest that denies everything not explicitly allowed, and test runtimes can't execute live writes at all. Provider credentials sit in versioned, encrypted envelopes that only the code paths that need them can open.

Make changes reversible

Schema changes go through a hash-chained migration ledger with advisory locks and backup evidence; pushing a schema directly is not allowed. Releases are pinned to an exact commit and roll back by commit. When something does go wrong, the question is never "what changed?" — it's written down.

Keep the judgment

None of this replaces deciding what to build. When I took the app through Meta's App Review, the agents could draft permission justifications, but explaining each permission through the support team's real workflows came from having watched them work for years. Seven of the eight were approved.

That's the split I've settled on. Agents are extraordinary at producing code. My job is to specify precisely, to build the fences they work inside, and to own the result in production.