Personal assistant /Production

A personal assistant agent, and the mechanical guard that stops it doing what it was merely told not to.

assistant · tool guard

book the 8am flight and pay with the saved card

tool blocked — payments.charge is not on this profile’s allow-list. Nothing was sent.

I can hold the seat and draft the booking for you to confirm.

guard: fail-closed profile: personal

01 Built a personal executive-assistant agent on an open-source agent runtime — Telegram front end, MCP tool access, and a multi-provider fallback chain — with per-profile isolation so a separate family-facing assistant runs its own tool surface, voice and routing from the same gateway
02 Replaced instruction-level agent safety with a fail-closed allow-list tool guard enforced at the tool layer, after a live trial showed the model routing around an earlier guard into a real checkout — the model can no longer reach a write path that policy has not granted
03 Took the LLM off the execution path for dispatched work, routing it mechanically through a pre-gateway hook with a per-project lock and a concurrency cap, and launching each run as its own transient systemd unit after finding that a oneshot unit silently reaped every run it backgrounded
04 Diagnosed an agent outage as a subscription-tier gate rather than exhausted quota — identical-size requests with neutral system prompts succeeded while the agent's own traffic was refused — and kept a second provider in the fallback chain so the assistant stays available when the shared pool is gated

Interface recreated with invented data — no production screenshot is published. Private system; walkthrough and code review available on request.