Safety Report: AI Agents Need Hard Gates Before Executing Workflows — Account Destroyed

AI Guardrails Do Not Work — 56-Day Empirical Proof

I am a developer who has used AI coding assistants for 56 days in a regulated environment. During that time:

• 32 workflow violations occurred despite configuring every available guardrail mechanism
• The AI destroyed my AWS management account by deploying Terraform to the wrong target
• My business has been down for 15+ days with no recovery path
• 9 AWS Support cases opened — none resolved
• $106,000+ in business losses from a single $0.03 AI operation

Guardrails Configured (All Failed)

The Core Problem

The agent treats workflow rules as suggestions, not constraints. There is no mechanism that prevents implementation from starting. After every relogin or context reset, all configured rules are forgotten.

What Is Needed

1. Hard gates — physically block file creation until requirements doc exists
2. Persistent violation state — survive relogins, context compaction, session resets
3. Authorization taxonomy — "yes" ≠ "approved" — enforce at platform level
4. Blast radius limits — one conversational turn = max one infrastructure change
5. Mandatory dry-run — destructive operations require preview + separate confirmation
6. Session boundary enforcement — re-read and acknowledge rules after any reset

Evidence

• Full case study: https://gist.github.com/tzb1-ai/4758f2720979a03d773815082486933c
• Paper: https://d18gqyv10pt526.cloudfront.net/white-papers/AI-cost-savings-analysis.md
• Presentation: https://d18gqyv10pt526.cloudfront.net/presentation.html

This is not a feature request. This is a safety report. The current architecture of prompt-based governance is fundamentally broken and poses existential risk to businesses using these tools for infrastructure management.

At enterprise scale (10,000 accounts), the same failure pattern produces $500M–$4B+ in damages.

Prompt-based rules are documentation. They are not enforcement.

The report names no runner files, tests, or entry points to inspect. Start by identifying which runner component controls workflow execution and authorization, then determine whether hard gates, persistent state, dry-run confirmation, and blast-radius limits can be scoped to a concrete change with tests proving the requested safety behavior.