When AI Stops Answering and Starts Acting, "Trust Me" Isn't Enough

Most AI you have used only talks. It answers a question, drafts an email, summarizes a report — and a person decides what to do with the output. The stakes are low, because nothing happens until a human moves.

The moment you let AI act — deploy a change, edit a live record, run a command against production — that changes completely. A wrong answer is an inconvenience you can catch. A wrong action is an incident you have to clean up. So when we build agents that do things, not just say things, the engineering is mostly not about making them capable. It is about making them safe to be capable.

Here is how we do it. It is the same principle behind everything we build: never assume, verify.

Scoped keys, not master keys

An agent is only as dangerous as the credentials it holds. So none of ours hold much.

Every API token an agent uses is scoped to the least privilege the job requires — a read-only key for anything that only needs to read, a narrowly permissioned key for the few things that write. Those secrets live encrypted in a dedicated secrets manager (Bitwarden Secrets Manager), never in the code, never in a config file, never baked into the agent. At the moment of execution, the specific secret is pulled from an internal vault, used, and dropped. Sessions run on freshly minted, read-only tokens that are single-use by design and never persisted anywhere that outlives the work.

The practical effect: even in the worst case, an agent cannot reach past the small, deliberate surface it was handed. There is no master key sitting in memory waiting to be misused.

Two models, one action you can trust

When an agent proposes to do something, one model is not allowed to be judge, jury, and executioner.

The agent that decides what to do runs on one model (GLM-5.2). Before anything executes, a second, independent model from a different maker (OpenAI's gpt-oss-120b) reviews the proposed action — not the eventual answer, the action itself. Is it coherent? Is it reversible? Does it match what was actually asked? Is there anything dangerous hiding in it — a command that would delete more than intended, a change to something it should not touch?

We use models from different families on purpose. Two systems built by the same lab tend to share the same blind spots. A reviewer that thinks differently from the proposer is a reviewer that catches what the proposer would have missed. It is the same pattern our verification platform uses on answers, applied to actions: one model does the work, a different one checks it, and the check happens before the deed, not after.

If that reviewer is unavailable, the system fails closed — the action waits rather than running unreviewed. Safe is the default, not the exception.

Simple things flow. Consequential things wait for a person.

Not every action deserves the same friction. Reading a record, listing what exists, making a new, additive, easily reversible change — these are low-stakes, and once the independent reviewer clears them, they simply proceed. The system stays fast where fast is fine.

Consequential actions are different. Deleting data, deploying code, changing a secret, running a command that alters live systems — these stop and wait for a human to approve them. And this is the part we are most deliberate about: the agent cannot approve itself. The authority to say "yes, execute this" comes from a person through a separate channel the agent has no way to reach. It can propose, it can explain, it can make its case — it cannot wave itself through. A human sees exactly what is about to happen, why, and the independent reviewer's opinion of it, and makes the call.

Fast where it is safe, deliberate where it counts, and a real person on anything that would be expensive to undo.

After the fact: did it actually do what it was asked?

Executing an action is not the same as succeeding at it. So once something runs, we check the result two ways.

First, deterministically: the system records the state before and after and confirms something actually changed. Then a lightweight model (Meta's Llama-3.3-70B) reads the before, the after, and the result and answers a plain question — did this do what it was supposed to do? Not "did it run without an error," but "did the outcome match the intent." Every step of this — the proposal, the reviewer's verdict, the approval, the result, the after-check — is written to an audit log you can go back and read. Nothing an agent does is invisible.

What the agents actually do

This is not theoretical. These agents run real operations every day, and the guardrails are shaped by what each one touches:

The infrastructure agent manages cloud services — DNS, storage, deployments, database changes — entirely through the propose-verify-approve-execute loop above. The finance agent is deliberately read-only: it can see accounts and balances, and it has no ability to move money, by construction. The email agent drafts replies and never sends them — a person always presses send. Others handle scheduling, customer records, and knowledge retrieval, each scoped to exactly what it needs and nothing more.

The pattern repeats everywhere: the capability is narrow on purpose, the credentials are scoped on purpose, and the consequential path always runs through a person.

Never assume — even of our own agents

It would be easy to build agents that are fast and impressive and quietly trust themselves. That is most of what "AI that takes action" means in the market right now, and it is exactly the thing that turns into a headline.

We took the harder path because it is the only one we would put our name on. The discipline we apply to AI answers — an independent check, a hard gate, a human where it matters — is the same discipline we apply to AI actions. The agent is a tool that earns a small, scoped, revocable amount of trust, verified at every step. It is never a thing we simply believe.

Never assume, verify. It turns out that is exactly what you want standing between an eager AI and your production systems.

Noevant builds AI systems for businesses that need their AI to be right, not just fast. If you want AI that can actually do the work — safely — let's talk.