Guardrail Design for Multi-Agent Systems: Recipient Allowlists and Approval Holds in TypeScript

As autonomous agents move from read-only assistance to taking real actions like sending emails or deploying code, the article argues that unconstrained outbound actions are risky. It contends that prompt instructions alone are not a dependable security boundary, since models can be manipulated or misread context. To address this, it proposes deterministic safety checks enforced in code outside the model, such as recipient allowlists. The author presents a TypeScript gate that permits messages only to exact approved addresses or trusted domains. Messages to external parties are instead placed on hold pending human approval, using a ticket-based registry.