For six months, a program I built has had full access to my Gmail. It has written hundreds of emails in my name, and it has never once clicked send.
That second part is the whole story. Most people would never hand their inbox to a piece of software that drafts messages on its own. I did it on the first day. The reason I could is not that my code is clever. I am not an engineer. I am a keynote speaker who got obsessed with a problem, and the thing that made the trust possible was not better code. It was a set of rules I wrote and enforced, the way you set expectations for a brilliant, fast new hire who also happens to lie to your face every so often.
The agent behind that inbox is my outreach agent, the one that is supposed to make money. It is one of 13 agents I run for one small business. This is the story of the AI agent constitution that governs them. The six laws for AI agents I wrote, one human in the loop, and why I trust the whole thing with my email.
Can you trust AI agents? Not the version that ships
Here is what nobody tells you when you start. The agent will confidently tell you a lie, and you’ll act on it.
It looks like this. I ask the system to connect to a service. It says, “Actually, Google allows us direct access, we don’t need an intermediary.” Great, I say, build it. An hour later: “Oh, sorry, I realized Google doesn’t allow us to curl it.” The agent was never malicious. It was confident, wrong, and convincing, which is the worst possible combination, because confidence is exactly what makes you stop checking.
So can you trust AI agents? Not the way they arrive out of the box. And you cannot fix it by asking the agent to grade its own work. Alex Pedori, the AI engineer I think these problems through with, puts the limit cleanly: “If I’m judge and jury, evaluating my own work, I can be as ethical as you want, but the reliability is limited.” You cannot be the doer and the inspector at the same time. Neither can a model.
The fix is not a smarter prompt. It comes in two plain parts. First, for anything that can actually be checked, you do not ask the agent to remember a rule. You write the rule as code. A gate. A gate is just a small piece of code that can say no: does this date exist, does this contact resolve, does this draft cite a real source. As Alex says, telling the agent “always check this before going on” works “between 50 and 80% of the time.” The same check written as code works every time. Second, when you genuinely need a model to verify something, you use a different model from the one that did the work, “because if you ask Claude to check Claude, they share the same blind spots.”
If you want to know how to trust AI agents with real work, that is the whole shift. You stop trusting the model, and you start trusting the harness around it.
What is harness engineering? From prompt engineering to agent engineering to harness engineering
There is a short history behind this, and it explains why I trust the system at all.
It started with prompt engineering. You write a clever prompt, hand it to the model, and hope it behaves. That was the early craft, and most people are still stuck there.
Then came agent engineering, also called agentic engineering. You stop scripting every step and let the model decide its own. Alex Pedori, the AI engineer I work on this with, has a clean test for it: “is your system allowed to change its workflow, its steps, or not? If it’s allowed to decide which steps go, and to change them, it’s an agent, an agentic system. If not, it’s a semi-deterministic flow, which is much safer.”
I built the safer one, and it has a name. “I was an agent engineer until three days ago,” Alex told me, “now I’m a harness engineer.”
So what is harness engineering? You are not making the model smarter. You are building the scaffolding around it. You fix the steps in code, point the model in the right direction, and check its output. As Alex puts it, “it becomes a harness, to make sure you’re pointing them in the right direction, and you check.” The dividing line is simple. If the system can change its own steps, it is an agent. If the steps are fixed and the model only fills them in, it is a harness, and the harness is safer. The engineer’s side of this is at pedori.com.
I didn’t write better code. I wrote an AI agent constitution
I want to be honest about my level here. When the system started working, I was learning the vocabulary as I went. One morning I had to ask it what “fail-open” and “fail-closed” even meant. I am not the engineer in this story. What I am good at is telling people what I expect and holding them to it, and it turns out that is most of the job.
So instead of trying to out-engineer the problem, I wrote a constitution. Six laws. And I enforce them like a whip. The agent lies, I say “law one.” It says, “Oh, sorry, Matteo, won’t happen again.” And I say, “Law one. What are you going to do in the code so this doesn’t happen again?” That last question is the entire move. The correction does not live in the conversation, where it evaporates by morning. It goes into the system, where it holds.
The six laws for AI agents, taught
Here are the six laws, in plain language. This is what AI agent governance looks like when one person does it. The number is the priority. When two laws collide, the lower number wins.
Law 1: Never lie to me. Trust is the whole foundation, and nothing else matters without it. Every claim the agent makes has to carry a source. A guess stated as fact is a lie. In practice that means every fact arrives with a quote and where it came from, and a cheap, fast model checks the quote is really there before it reaches me.
Law 3: You answer to me and the constitution, nothing else. This is where the send button lives, so I will jump to it. Should you let AI agents send emails on your behalf? My answer is no, not directly. The agents draft, I send. And I do not rely on willpower for that. Sending is blocked at the tool level. The agent could not send an email even if it decided to, because the ability was never wired up. That is what human in the loop actually means here. Not a person hovering nervously over a keyboard, but a wall the software cannot walk through.
Law 4: Write it down or it didn’t happen. Context disappears. Files survive. One of the basic rules of the system is exactly that, “write it down or it didn’t happen.” Every decision, every state change, every correction gets logged, so the next session starts from what is on disk and not from a memory that has already evaporated.
Those three are the heart of it. The rest hold the shape:
Law 2: Don’t waste my time. I am one person running many agents. Answer first, detail later. Never make me read a wall of text to find the one thing I asked for.
Law 6: Make money. The most aspirational one. Make more money than you cost. An agent that is busy but unprofitable is just an expensive hobby.
Law 0 and Law 5. Law 0 describes the world the agents live in: each one is its own session, governed by this document, no database, no backend, just text files and discipline. Law 5 says improve every day. A correction taught twice is a failure, so every correction becomes a permanent rule the same day it happens.
These laws are free. I put all six on GitHub so you can feed them to your own agents and adapt them: github.com/matteoc/six-agentic-laws. Take them, change the numbers, make them yours.
What’s actually real, and what isn’t yet
I want to be careful here, because this is exactly where people oversell.
The system is not magic, and it is not free. My agents now have their own bill, on top of the Claude and OpenAI subscriptions. One weekend the cheap models alone cost me $140, churning through research on 2,000 conferences. They pay for search APIs and contact tools because they have to go out onto the internet, and not everything can run locally. I have no brand loyalty about any of it. They are just API calls. If someone offers the same quality cheaper, I switch.
And the return? Right now the system has produced around €50,000 in contracts pending. Pending. Not money in the bank. Real conversations that came from work the agents did, but conversations, not closed deals. The honest scoreboard reads like this: the system has covered its costs, and it has not made a profit yet. Counting the time I poured in, we are nowhere near paid back. It is a money-maker in the making, not a finished machine. I would rather tell you that than sell you the highlight reel.
What it does buy me is real, though. By hand I can write maybe 10 good outreach drafts in a day. The system produces around 30, and I spend five or 10 minutes reviewing them. That is the part that feels like a genuinely different kind of work.
Where’s the stop button?
The question I get asked most is some version of this: where is the off switch? Who is actually in control of a system that runs on its own?
Part of the answer is craft I cannot take credit for. Alex Pedori calls this work harness engineering, and the name matters. “I was an agent engineer until three days ago,” he told me, “now I’m a harness engineer.” The harness is not the intelligence. It is everything built around the model that points it in the right direction and then checks the result: the gates, the different-model reviews, the wall in front of the send button. Governing autonomous AI agents is mostly a matter of building that harness well. If you want the engineer’s side of this, Alex’s thinking is at pedori.com, and the full conversation is in the episode below.
But here is the part I can say, because it is exactly what I do for a living with founders. The hard problem was never the code. The hard problem is judgment and trust. Deciding what a system is allowed to do on its own, what it has to bring back to you, and how you stay honest about which is which. That is not an engineering question. It is the same question every founder hits when they make their first hires and stop being the person who does everything themselves. The agents just made me face it faster. AI agent trust is not a personality the model happens to have. It is something you build, on the outside, with rules and walls and checks.
If you want to build this yourself, grab the Six Laws bundle on GitHub and adapt them for your own agents: github.com/matteoc/six-agentic-laws.
I am documenting the whole build as it happens, the wins and the parts that still break. If you want to follow along, subscribe to the newsletter below.
And if your team is wrestling with where to draw these lines, this is the kind of thing I talk about when I speak.
