This is exactly the right mental model. "Language is soft, infrastructure is hard" is the core insight most teams miss until they've been burned. The Unix escalation analogy is spot on.
We've been building in this space and the pattern we keep seeing is teams implement exactly what you described, then hit a wall when they have 3+ agents, or a new engineer joins, or they want to audit what happened across 10,000 agent runs last week.
What we built is essentially the infrastructure layer you're describing, but as a centralized control plane. Same primitives (structural constraints, escalation rules, audit-first for irreversibles), but portable across agents and visible to the whole team.
Curious — are you managing these identity files manually per agent, or do you have a system for it?
6 months and 1100+ receipts to get to useful patterns — that's the hidden cost nobody talks about. The governance layer is 'boring' but it's also 6 months you're not spending on the actual agent. That feedback loop from receipts to dispatch quality is exactly what we're building as infrastructure so teams don't start from zero.
Understanding intent and following instructions are different failure modes. LLMs are good at the first, unreliable at the second. That's exactly why enforcement lives outside the LLM.
Sandboxed execution is solid for isolation — separating proposal from execution is the right architecture. The piece we kept hitting was the policy layer on top: who defines what the agent is allowed to propose in the first place, and how do you update those rules without a redeploy every time?
Fair. We didn't choose LLMs to enforce rules — we chose them to understand intent. The enforcement happens outside the LLM entirely. That's the separation that actually holds up in production
The separation between 'what the agent wants to do' and 'what it's allowed to do' is the right mental model.
The append-only ledger point is underrated too — pattern data from real failures is worth more than any upfront rule design.
How long did it take to build and maintain that governance layer? And as your agent evolves, do the rules keep up or is that becoming its own maintenance burden?
Exactly right - the deterministiclayer is the only thing you can actually trust.
We landed on the same pattern: LLM handles the understanding, hard rules handle the permission. The tricky part is maintaining those rules as the agent evolves. How are you managing rule updates code changes every time or something more dynamic?