Every agent inherits the same five safety primitives. They aren't opt-in features; they're the floor the executor runs on.
The five primitives
- Kill switch — operator-owned flag on stores.config, off by default. When you flip it on, every worker job that writes or spends refuses to start (logged as a skipped run); read-only ingestion, reporting, and alerting keep going.
- Per-action rate limits — cap writes per hour, per action type, per store.
- Tier-A discount gate — discount_test, the only price action, requires verified cost data plus a margin floor.
- LLM budget cap — a monthly per-store ceiling on model spend, enforced against month-to-date usage.
- Advisory locks — Postgres advisory locks serialize work on the same store so two cycles never collide.
The tunable flag
{
"anthropic_monthly_cap_usd": null,
"anthropic_daily_cap_usd": null
}Each store has a monthly model-usage cap, enforced against month-to-date usage. Left unset (null), it is the larger of a platform floor and your plan's allowance, which rises with each tier; a daily sub-cap keeps one busy day from spending the month. When a store reaches either, the current unit of work is skipped rather than the whole job aborted. Raise it as your decision_log accrues clean rows — never the other way around. The kill switch and advisory locks are not tunable; they always run.
Failure direction
The chain fails in a chosen direction: fail-open on propose, fail-closed on dispatch. If a check can't be evaluated, the system can still write a proposal for a human to read — but it can never execute a write. When something is broken, you get more review, never more autonomy.