Do we need this if we are a small business, not an enterprise?

You need it more, because there is no security team to catch what the system did. The version for a small business is lighter — a short permission list, one approval queue, a readable log — but the principle is the same. It is far cheaper to add on day one than after an incident.

Will guardrails make the AI less useful?

Review steps can add friction, so they should fit the consequences of the action. We test that tradeoff on the scoped workflow. Adding approval checks alone does not establish that unattended operation is safe.

Can this be added to an AI system we already have?

Usually, yes. Permission scoping, logging and an approval queue can be wrapped around most existing systems. Where the existing design makes that impossible, I will tell you — that finding alone is worth the review.

What is an autonomy level, in practical terms?

A written statement of what the system may do without a human, from read-only up to irreversible changes. Each level withholds specific actions — deploy, spend, production writes — and moving up a level is an explicit decision made after the system has proven itself at the level below.

Who can see the audit log?

Whoever you decide. It is stored where you control it, in a format a person can read, and it is yours. Nothing about the log depends on me or on a third-party service you might stop paying for.

You want clearer approval steps and visibility into an AI workflow.

Approval workflows and activity logs

Application-level approval checks and activity records for a defined workflow. Not a penetration test, compliance audit, or guarantee of complete isolation.

The situation

An AI workflow may need a clearer distinction between preparing work and taking an external action. I can help implement approval steps and activity records around a defined part of an application.

My experience here comes from building and testing my own tools, including Sentinel. This is scoped software development, not a formal security assessment, penetration test, or compliance service. If the project requires specialist assurance, that needs a qualified specialist.

How I approach it

Permission boundaries per action, not per system

We identify the actions the workflow needs and inspect the permissions available through its services. Application approval checks are tested separately from platform or OS restrictions. Any access that cannot be restricted as intended is documented, not described as impossible.

Explicit autonomy levels

Every system gets a stated autonomy level that says, in plain terms, what it may do without a person: read only; propose changes; make reversible changes; make irreversible changes. Deploys, spend above a threshold and production writes sit at levels a system is not granted until it has earned them through weeks of supervised operation. Raising the level is a decision you make deliberately, not a default you inherit.

Audit logs that answer the actual questions

We choose the events needed to understand this workflow, with attention to sensitive data, retention, and access. The handoff explains what the logs capture, what they miss, and any usage figures that are estimates.

Approval queues for anything you cannot undo

Some actions should never be automatic, no matter how good the model is. Sending money, deleting data, contacting a customer, changing production. Those go to a queue where a named person approves or rejects them, with the context needed to decide in seconds. The system does the preparation; the human keeps the decision.

Written down, so it survives you and me

The handoff documents the agreed actions, approval rules, checks, and known gaps. That gives you a practical reference for maintaining the workflow; it is not a certification of the surrounding infrastructure.

What gets delivered

A map of the workflow's actions and permissions
Activity logging with documented coverage and limitations
Autonomy levels that withhold deploy, spend and production writes
Human-approval queues for anything irreversible

What it costs to get wrong

An agent with broad credentials that misreads an instruction and modifies something it was never meant to touch, with no record of which step did it.
A client audit or a security questionnaire you cannot answer, so the deal or the renewal stalls on 'what does your AI have access to'.
A team that quietly stops using the system because nobody trusts it, after the budget has been spent.
The discovery, weeks later, that a system has been spending or writing far more than anyone assumed, because nothing was counting.

Why you can believe this

Sentinel is my independent local-first coding-agent project. Its approval checks have regression tests; it is not an OS sandbox or a security-certified product.

Explore the work Read the ai-os case study

Questions buyers ask

Do we need this if we are a small business, not an enterprise?: You need it more, because there is no security team to catch what the system did. The version for a small business is lighter — a short permission list, one approval queue, a readable log — but the principle is the same. It is far cheaper to add on day one than after an incident.
Will guardrails make the AI less useful?: Review steps can add friction, so they should fit the consequences of the action. We test that tradeoff on the scoped workflow. Adding approval checks alone does not establish that unattended operation is safe.
Can this be added to an AI system we already have?: Usually, yes. Permission scoping, logging and an approval queue can be wrapped around most existing systems. Where the existing design makes that impossible, I will tell you — that finding alone is worth the review.
What is an autonomy level, in practical terms?: A written statement of what the system may do without a human, from read-only up to irreversible changes. Each level withholds specific actions — deploy, spend, production writes — and moving up a level is an explicit decision made after the system has proven itself at the level below.
Who can see the audit log?: Whoever you decide. It is stored where you control it, in a format a person can read, and it is yours. Nothing about the log depends on me or on a third-party service you might stop paying for.