---
title: "The tools are the product"
date: 2026-04-01
series: 1
summary: "Autonomous agents touching production is a terrible idea."
voice: architect
tags: [agentic-safety, human-in-the-loop, tool-surface, blast-radius, audit-log, langgraph, production-mutation]
image: "/notes/pentest-agent/image.png"
imageAlt: null
linkedin: null
sources: []
dateApprox: true
---

Autonomous agents touching production is a terrible idea.

Autonomous agents touching production, behind a 5-second human gate, is a product.

We shipped a LangGraph multi-agent system this quarter that mutates state in an enterprise customer's production environment. Three things I'd tell anyone building agents that touch real systems:

**1. Your toolbelt is the product.**

The LLM picks. Your tools decide what's possible. If `run_command` exists, someone will run `rm -rf /`. We locked the toolbelt before we tuned a single prompt. Every tool has a named blast radius, a rate limit, and a scope the planner cannot widen.

**2. Human-in-the-loop is a UX problem, not a safety feature.**

If the review gate takes 40 seconds, your operator auto-approves by week two. We built a 5-second review: diff, blast radius, one-click undo. Approval rate dropped from 100% to 62%. That 38% is the product working.

**3. The audit log is not a side-effect. It is the product.**

Procurement reads it. Insurance reads it. The customer-facing report is generated from it — by a narrator node that cites every claim with an evidence hash. We designed the log schema before we designed the agent graph.

Stack: LangGraph + self-hosted open-weights models + a disciplined tool surface. No OpenAI key in the build. Runs inside the client's VPC. The team sleeps.

If you're building agents that touch anything destructive — infra, code, money, or customers — the same three rules apply. The model is not the hard part.