When you are the human in the loop, you are the safety layer by default. The moment you remove yourself, that layer must already exist inside the system.
Autonomous operation is the goal most serious AI practitioners are building toward. It is also where most of the risk lives.
Right now, if I give my AI system an instruction, I review what it does. I see the output. I authorize the commit. I am present at every significant decision point. That presence is a safety layer I take for granted because it is just how I work.
The moment I deploy on a separate machine and let it run without me, that safety layer disappears. Unless I have already built it into the system itself.
There are two things most practitioners do not understand about this transition.
The first is the difference between prompted constraints and structural constraints.
A prompted constraint is a rule in a markdown file that the agent reads. It works when you are present, because you can catch it if the agent ignores it. For autonomous operation it is not enough. You need structural constraints: limits enforced at the file system and configuration level, not inside the prompt. A research agent should be structurally unable to reach the clients folder, regardless of any instruction it receives.
A prompted constraint is a sign. A structural constraint is a locked door.
The second is physical separation.
Your autonomous system must not run on the same machine as your personal data, your client files, or your primary working environment. A compromised orchestrator on a shared machine can reach anything the machine can reach. Physical separation means the blast radius of any failure is contained to the sandbox. Your personal machine stays unreachable.
The checklist I use before enabling any autonomous capability:
- Constitutional constraints documented and loaded by every agent
- All files classified. Gitignore verified.
- Behavioral logging active in session-open, session-close, and commit commands
- Thirty days of baseline logs collected
- Anomaly signals defined from real data
- File access restricted at the structural level
- Autonomous system on a physically separate machine with zero shared drives, credentials, or API keys
- Escalation pathway defined for every anomaly type
Every item must be complete. Not most of them. All of them.
The practitioners who will be trusted with serious client work in the next 12 months are the ones building this now, before something forces them to.
Which item on the checklist are you completing this week?
Tom Olakitan is the founder of Cerebrium Consulting. He helps BC-based SMBs build AI operating systems that are secure enough to trust and practical enough to use.