Skip to main content
Governance is not only about what an agent is allowed to do. It is also about what happens when one misbehaves.

​
Circuit breakers

Per-agent counters over a rolling window, on three signals: Crossing a threshold freezes the agent: every subsequent request is refused before anything is analysed, and its pool is drained. Nothing it asks for should be considered until a human has looked at why it was frozen. Reinstating is deliberate and always attributed, with a reason that is recorded. That judgement — “this was a stale enum value, not an attack” — is the most useful thing in the record when the same agent trips again next week. The automatic freeze is recorded too, with the evidence that triggered it, because that is the event a post-incident review starts from.

​
Loud failures

An agent that hallucinates a column name gets zero rows, and zero rows looks exactly like a fact. That is how an agent tells a customer they have no orders when they have six. Warden separates the cases:
  • Genuinely empty — the table has no matching records.
  • Suspiciously empty — the table holds records and the filter matched none of them, which is more likely a wrong value than a true answer.
The second attaches a warning the agent can reason about, and counts toward the breaker. A filter naming a field that does not exist does not even get this far: it is refused at parse, because an equality on a nonexistent field would otherwise read as a precise lookup while matching nothing.

​
Plan-aware idempotency

A plain unique key cannot express the difference between “the agent retried” and “the agent decided to do this again”. Warden’s key is the agent’s own idempotency key, checked against a fingerprint of the operation:
  • Same key, same work — replayed. The stored result is returned and the database is not touched.
  • Same key, different work — idempotency_conflict. The key derivation is wrong, and saying so beats silently running it.
  • Changed plan — plan_hash is part of the operation’s identity, so genuinely new work is new work.
Keys are journalled, so they survive a restart.
An operation in flight when the gateway crashed has its key marked outcome_unknown: whether it took effect is genuinely unknown. The agent is told to check the data and retry with a new key. Refusing a retry is recoverable; running a write twice is not.

​
Per-agent pools

Each agent gets its own connection pool with fail-fast checkout. One agent’s runaway query cannot starve the rest, and an agent that has exhausted its own slots is told so (pool_exhausted, retryable) instead of queueing behind itself. Queueing is how one agent takes down everyone.

​
Reads run read-only

For PostgreSQL, reads execute in read-only transactions. Classification already decided it was a read; the transaction mode is an engine-enforced backstop under that decision, so a misclassification cannot become a write.