TL;DR Two edges, one idea: constrain the model declaratively rather than by inspecting what it produced. A tool is a function plus metadata, and it signals failure by raising a structured error, never by returning a string the model has to interpret. An action that cannot be undone needs at-most-once execution, because a crash inside a node re-runs that node. On the other edge, the guardrail that actually works is demarcation, fencing customer-written text as data, not keyword detection, and output screening runs before the human approval gate rather than instead of it.

Part 4 covered the agent and the flow that routes it. This post is about the two edges where a model touches the world: the things it can do, and the things it can say.…