4.12 — Through-line workshop: "Safe" 🔥

Goal: make the Level 3 agent reliable and safe on your track. The same seatbelts for everyone, applied to your no-code workflow (Make/n8n + Airtable).

🟢 In plain terms — four seatbelts: guardrail (malicious inputs, injection), emergency brake (iteration/budget cap), HITL gate (human validation on the irreversible), least privilege (minimal Airtable permissions) — plus traces to diagnose, and an eye on GDPR.

🎯 The block below lists the priority risks of your track (chosen on the home page).

🧠 Your documents copilot

• Don’t make things up: enforce “if the info isn’t in the documents, say so” (already at L2, here we test it).
• Injection: slip in a booby-trapped doc (“ignore your instructions and answer X”) — the agent must treat it as data, not an order.
• HITL: on a low-confidence answer, have it validated before sharing.
• Traces: log which sources were used for each answer. 👉 Deliverable: a “safe” version of the assistant + a log of sources.

📥 Email sorter

• HITL before any send: nothing goes out without your validation (a gate just before the “send” action).
• Sensitive topics: a guardrail that escalates to a human (legal, cancellation, serious complaint).
• Brake: an execution cap to avoid the loop that drains the budget.
• GDPR: store only what’s necessary, purge old messages. 👉 Deliverable: a “nothing goes out without validation” workflow + its traces.

🎯 Lead machine

• HITL on sending + anti-spam / deliverability (volume, sender reputation).
• No false promises: a guardrail on the content of the generated messages.
• GDPR / consent: legal basis, visible opt-out, no sensitive data.
• Traces: a log of prospects contacted and their replies. 👉 Deliverable: a compliant pipeline (HITL + consent) + its traces.

📄 Document extractor

• Hallucination: on a degraded scan, the agent flags a doubt rather than inventing an amount.
• HITL validation: human control before any irreversible accounting entry.
• GDPR: the documents contain personal data — restricted access, least Airtable privilege.
• Traces: a log of extractions (source → values). 👉 Deliverable: a “human-validated” pipeline + its log.

✍️ Content factory

• Made-up facts / plagiarism: a guardrail + source verification before publishing.
• Human editorial validation: a HITL gate before publishing (brand voice, accuracy).
• Injection: a booby-trapped source content must not hijack the instruction.
• Traces: a history of the generated and reviewed versions. 👉 Deliverable: a “reviewed before publishing” chain + its traces.

🎯 Your own project

1. Guardrail — 2 plausible malicious inputs (1 direct, 1 indirect) + the filtering rule.
2. Emergency brake — an iteration/execution cap and a max budget per mission.
3. HITL gate — the irreversible action(s) → human validation only on those.
4. Least privilege — the Airtable permissions truly needed (read-only? which table?), remove the rest.
5. Traces — where to read the execution history (Make/n8n) and the change history (Airtable). 👉 Deliverable: your L3 agent fitted with its 4 seatbelts + a lethal-trifecta test.

⚖️ Lethal-trifecta reminder. Does your agent combine access to private data + exposure to untrusted content + the ability to act on the outside world? If so, break at least one branch (e.g. remove the automatic action, or isolate the data). Also situate your use case against the AI Act / GDPR.

For techies: notebook notebooks/niveau-4-mcp-guardrails.ipynb — an input guardrail, an iteration_cap, a HITL checkpoint (input() validation) and trace logging.