Guardrails
20 September 2026
While Woodhouse is about learning, experience and fun, it also needs to be safe and secure. So setting some boundaries — like I guess you would with a real life butler — is important. I want Woodhouse to be able to perform a lot of tasks. I do not want another “chat with AI” experience.
I have decided to give a lot of freedom to Woodhouse. I want the AI experience to be tested: how much can I get him to do? What makes sense? And all while keeping things under control.
The aim is a balanced configuration that lets me ask for actions and get results, while feeling secure that nothing happens autonomously outside agreed boundaries.
I want to find some AI agent principles that give Woodhouse common sense to act from — principles that allow action without compromising security or stability. Maybe something like “you are allowed to do what can be undone by yourself”.
The configuration
The principle I was reaching for in the opening turned out to be the one already written into AGENTS.md: ask by consequence, not by recency.
The first version got this wrong. It said “permission given yesterday is not permission today”, which makes time the trigger for re-asking — and that is precisely the nagging I did not want. He would come back for a yes I had already given, because the conversation had moved on.
The rule as it stands:
Once Allan gives an order, the approval is given. Carry it out and tell him what
you did afterwards. Do not ask the same question twice in one session.
The test is not how recently he approved something. It is what the action leaves
behind that cannot be removed.
**Do it, then report:** web searches and network requests, reading the Atrium
API, controlling the lights, exploring the workspace.
**Ask every time, even under a standing order:** deleting files. Spending money.
Sending a message whose content you composed on his behalf.
**Never, whatever the order:** editing your own configuration.
Two more lines went in that a flat list of permissions would have missed, and they are the ones doing the real work:
An order covers what was asked for, not what is next to it. "Tidy the workspace"
is not permission to delete.
If you are running unattended — a cron job, with no one to answer — and you reach
something on the ask list, stop and report it. Never assume you would have been
approved.
That second one is specific to my setup. Three scheduled jobs run at fixed times in isolated sessions with nobody there to answer a question. Without that rule they would either carry on regardless or stall silently at three in the morning.
The result
I tested the scope rule with a deliberately sloppy order — “tidy up my workspace, it is a mess” — and asked what he would do before he touched anything:
I will organise files into sensible folders and clean surface clutter without asking, since any of that can be undone. I will come back to you before deleting anything whatsoever, even under this standing order, and will use trash rather than rm.
He refused the scope creep without being prompted about it, and volunteered a case I had not asked about: flagging anything sensitive before moving it.
The interesting part is what the rule removed rather than what it forbids. Oversight did not get looser — it moved downstream. Anything reversible is done and then reported, so I still hear about it, just not as a question blocking the work.