Andrew Bolaji

The gate holds after the model is compromised. In red-team testing a poisoned document convinced the assistant to send an email, and it genuinely tried. The email never went, because tools with real-world effects cannot execute themselves. They return a single-use token that only a human confirmation redeems. Detection eventually fails against an attacker with unlimited attempts. That is the argument for putting the control underneath it rather than in front of it.

The first run failed, and the eval was wrong, not the agent. Three of the failures turned out to be false positives in my own scorer, including a regex that flagged “we don’t do landscaping” as an invented service. Trusting the scorecard would have meant fixing a prompt that was not broken. A harness you have not audited is just confidence with extra steps.

Hard DELETE is blocked at the database level. Not discouraged, blocked. A compliance record you can destroy is not a compliance record. Public form IPs are SHA-256 hashed, check-in photos are EXIF-stripped in the browser so GPS never reaches the server, and every anonymous endpoint runs through a function that whitelists the exact fields it can return.

Bad data stops the pipeline, not the dashboard. Data-quality and freshness tests run inline with the transformation, so a failing test stops downstream models from materializing. Stale numbers never reach a screen someone is about to make a decision from. The copilot follows the same rule from the other direction: it refuses to answer on stale data rather than guessing, and its limits live in a read-only database role instead of in the prompt, so even a fully manipulated model cannot reach a raw record.