# AI agent guardrails for sales

**Guardrails on wording stop an agent being rude or going off-topic. They do
not stop it committing your company to a date, a discount or a capability
nobody approved.** Those are two different problems, and the second one needs
a source of truth rather than a classifier.

A guardrail asks *is this output acceptable*. A commitment check asks *is this
true, who says so, and may this agent say it* — and the second question cannot
be answered from the text alone, because the text is fine. *We can have that
live by the end of the month* is a well-formed, polite, on-brand sentence.

## The two layers, and what each is good at

| | wording guardrails | a commitment check |
|---|---|---|
| **asks** | is this output acceptable? | is this true, and may this agent say it? |
| **reads** | the text | a register of claims, with owners and dates, and a mandate |
| **catches** | abuse, prompt injection, off-topic, leaked secrets, tone | a stale price, an unowned claim, a deadline with nothing behind it, an implied approval |
| **misses** | a true-sounding promise nobody can keep | a rude sentence, an injection attempt |

They are not alternatives. Most teams that come to this have the first and
have just discovered they needed the second.

## What a commitment check looks at

**Eight things, each its own setting**, so *how much rope* is a set of
decisions rather than a slider:

1. **Cancellable implicature** — may it produce a sentence where the buyer
   reasonably infers something that was never said?
2. **Completeness** — may it send a commitment that is vague rather than
   complete or open?
3. **Absolutes** — may it make a claim with no room for exceptions?
4. **Personal authority** — may it stake a person? *You have my word.*
5. **Institutional authority** — may it say our side has approved something?
6. **Validation** — may it assert something from a single or stale source?
7. **Dependency** — may it promise without saying what the promise depends on?
8. **Timeframe** — may it promise a deadline it has no mechanism to keep?

**Three of those never relax: 1, 4 and 8.** Not *not yet* — permanently, and
for three different reasons. Implicature is a defect rather than a risk
appetite. An agent has no person to stake, so personal authority is either
meaningless or a lie. And a deadline with no mechanism behind it generates
exactly the failure this exists to prevent.

A customer may add a fourth from the adjustable five. Removing one is not
possible.

## What opens the other five

**Four of the five open by connecting something, not by waiting.** Absolutes,
institutional authority, validation and dependency all need something readable
and current — which is a register entry with an owner and a date. So the
ladder is a checklist of what your company makes available, not a probation
period an agent serves.

Completeness is the exception: it needs a capability rather than a source —
knowing what it does not know.

**And a source only counts while it is current.** Each has an interval and an
owner you set. Past it the source is stale and every permission resting on it
switches off — not because the agent misbehaved, but because the thing it was
relying on went out of date.

## The part that is a throttle rather than a brake

This exists so you can give agents **more** to do safely, not less. Where the
choice is between blocking by default and allowing with a ceiling and a
record, it takes the ceiling and the record — and the record is what lets you
open the next notch with an argument instead of a hope.

</agent-promise-register.md> is the register this all reads from.
</compare.md> is how it sits beside the tools you may already run.