The AI agent guardrails I had to build before letting one spend money unattended

I shipped Cerevisor 1.9.0 this morning. Two of the headline features, Progressive Mode and Operator, share one uncomfortable property: they make paid API calls on a real provider key without a human pressing Run first. One builds and runs workflows piece by piece while the user chats. The other wakes up on a timer, looks at the workspace, and decides on its own what to do next.

Building the agent part took weeks. Building the part where I would actually trust it with a credit card took longer. That second part is what I want to talk about, because everyone evaluating an agent harness right now is about to run into the same question from the other side: not “can it act on its own” but “what happens when it does, and nobody is watching.”

Two features that spend money without a Run button

Progressive Mode is the friendlier of the two. Flip a switch in the chat builder, describe what the workflow should do, and Cerevisor restates the goal, builds one small piece, runs that piece, and reports back what it built, what came out, and what it cost. Then the next piece. If a later message asks it to change something already built, it detects that, says exactly what it is about to redo and why, and re-runs only the affected part. If a step fails, it gets one honest attempt at fixing its own mistake, then stops and asks instead of burning tokens on a loop. There is a fuller walkthrough in the Progressive Mode guide.

Operator is the one that kept me up at night. While the app is open, it checks the workspace on a schedule, every 30 minutes by default, and makes exactly one small bounded move: advance an objective it is already tracking, start tracking something new, or draft something useful for later, a skill, a memory entry, a workflow sketch. Then it goes back to sleep. A plain-language journal records every check-in and what it cost.

Here is the thing both features forced me to admit: the moment an agent initiates spend, the spend controls stop being settings and become the product. Nobody buys an unattended agent. They buy the confidence that the unattended agent cannot ruin their Tuesday.

The guard order: budget wall, per-check limit, review queue, auto-disarm

The guardrails stack in a specific order, and the order matters more than any individual limit.

First, the budget wall. Progressive Mode defaults to a $0.50 ceiling per step and a $5.00 budget per conversation. The release notes state it plainly:

Operator gets the same treatment at a daily scale: a daily budget that must be set before it can even be switched on, and when it is reached, paid checks stop until tomorrow and the user gets one notification. Not a warning it can dismiss for itself. A wall.

Second, the per-check limit. Inside the daily budget, each individual check-in is bounded too, so one runaway task cannot eat the whole day’s allowance in a single wake-up. Self-improvement drafting gets an even smaller slice, a quarter of the daily budget by default.

Third, the review queue. Everything Operator drafts lands in a queue where the user reads it, sees what evidence it is based on, and chooses Accept or Discard. Nothing is applied automatically, ever. This was a hard rule I refused to soften, and it cost real convenience. An agent that could quietly install its own improvements would demo better. It would also be exactly the thing I would never run on my own machine.

Fourth, auto-disarm. Three unsuccessful attempts in a row, failures or moments where it has to stop and ask for information, and Operator turns its own autonomy off and says so in the journal. A budget pause does not count against the streak; genuine dead ends do. I think of it as the agent knowing when to put the card down and walk away from the table.

The design decisions that were harder than the agent

A few calls in the full 1.9.0 release notes look small and were anything but.

Operator only runs while the app is open. Closing Cerevisor pauses it completely. No background service, no daemon checking in while the laptop sleeps. I went back and forth on this for weeks, because a truly always-on assistant is the flashier pitch. But an agent spending money from a process the user cannot see contradicts everything Cerevisor stands for as a local-first harness. If the window is closed, nothing is happening. That sentence is worth more than the feature it rules out.

Reach is sandboxed by default. When Operator drafts and builds on its own initiative, the work is confined to a separate folder: no internet, no outside services, no package installs, no source-control changes. Widening that to full access requires an explicit confirmation in Settings, and if that confirmation was never recorded, the system treats the setting as sandboxed no matter what the config claims. Full access cannot turn itself on silently, even by accident, even by file edit.

The kill switch lives on two screens. Stop from the desktop panel or from the phone; either turns autonomy off immediately. The Android companion grew into a real control surface this release, building and editing workflows, picking providers and models, mirroring the builder conversation both directions. But the feature I insisted on first was the Stop button next to the Operator journal, in a pocket, on a lunch break.

And one piece of honesty that made it into the docs rather than getting buried: Stop cannot cancel a check already in progress. If a check was mid-flight when the button was pressed, it finishes, and a small final charge can land after the switch is off. Estimates are checked before a step runs, not guaranteed to the cent. I would rather publish that sentence than have anyone discover it as a surprise on an invoice.

Nobody buys an unattended agent. They buy the confidence that the unattended agent cannot ruin their Tuesday.

What ai agent guardrails tell an executive about any harness

Zoom out from my release day and the pattern generalizes to every autonomy feature landing across the agent tooling market right now. Vendors will describe the agent. The evaluation should interrogate the walls. Four questions do most of the work:

Where is the budget wall, and who set the default? A harness that ships unattended autonomy with no default spend ceiling has decided the first bad invoice is the customer’s problem. Defaults are a statement of values; $5 per conversation says something different than unlimited-until-you-notice.

What applies without a human clicking Accept? The gap between “the agent proposes” and “the agent applies” is the entire governance story. If drafted changes take effect on their own, the review process is theater.

Does it know when to quit? An agent that retries forever converts every bug into a bill. A disarm rule, three strikes in Cerevisor’s case, turns failure from a cost center into a notification.

Can it be stopped from wherever the operator actually is? A kill switch on the desktop is table stakes. The person the agent is working for is, almost by definition, away from the desk.

The full walkthrough of the check-in loop, the reach setting, and the journal lives in the Operator guide.

What I’d tell a founder over coffee

Unattended agents are coming to every tool on the desk, and the anxious version of that story is overdone. The calm version: autonomy is a spend and permissions problem before it is an intelligence problem, and both of those are old, solvable problems. Budgets, queues, audit logs, off switches. We have run payroll on those primitives for a century.

So when a harness pitches an agent that works while everyone sleeps, skip past the demo and ask to see the walls. The vendors who built them will show them off with the enthusiasm I hopefully just displayed. The ones who wave the question away have told you the roadmap.

If this sounds like a set of trade-offs worth examining firsthand, the 1.9.0 release notes carry the complete list of what shipped today, and the download is free at cerevisor.com. Set the Operator budget to a number that would not hurt, and read the journal tomorrow morning. That first journal read is where the trust either starts or does not, and it should be earned in dollars small enough to laugh about.