# Agent Safety is a Box

DevFeed: [Agent Safety is a Box](<https://devfeed.tech/articles/agent-safety-is-a-box-12586.md>)

Original publisher: [Read original article](<http://brooker.co.za/blog/2026/01/12/agent-box.html>)

Author: Marc Brooker

Published: 2026-01-12T00:00:00Z

Content type: opinion

Language: en

Sources: [Marc Brooker's Blog](<https://devfeed.tech/sources/marc-brooker-s-blog.md>), [Marc Brooker's Blog](<https://devfeed.tech/sources/marc-brooker-s-blog-2.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [ai safety](<https://devfeed.tech/topics/ai-safety.md>), [Responsibility & Safety](<https://devfeed.tech/topics/responsibility-safety.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [ai-safety](<https://devfeed.tech/tags/ai-safety.md>), [mcp](<https://devfeed.tech/tags/mcp.md>)

## AI overview

The article argues that AI agents should be constrained by a strong, deterministic control layer outside the agent--a "box"--that limits which tools they can call and what they can do. It distinguishes safety from prompting, steering, and context management, which may improve success rates and cost but cannot provide sufficient guarantees for flexible and adaptive agents acting through side effects.

## Source excerpt

Agent Safety is a Box Keep a lid on it. Before we start, let's cover some terms so we're thinking about the same thing. This is a post about AI agents, which I'll define (riffing off Simon Willison1) as: An AI agent runs models and tools in a loop to achieve a goal. Here, goals can include coding, customer service, proving theorems, cloud operations, or many other things. These agents can be interactive or one-shot; called by humans, other agents, or traditional computer systems; local or cloud; and short-lived or long-running. What they don't tend to be is pure. They typically achieve their goals by side effects. Side effects including modifying the local filesystem, calling another agent, calling a cloud service, making a payment, or starting a 3D print. The topic of today's post is those side-effects. Simply, what agents can do. We should also be concerned with what agents can say, and I'll touch on that topic a bit as I go. But the focus is on do. Agents do things with tools. These could be MCP-style tools, powers, skills, or one of many other patterns for tool calling. But, crucially, the act of doing inference doesn't do anything. Without the do, the think seems less important. The right way to control what agents do is to put them in a box. The box is a strong, deterministic, exact, layer of control outside the agent which limits which tools it can call, and what it can do with those tools. Why a Box? The most important one of those properties is outside the agent. Alignment and other AI safety topics are important. Steering, careful prompting, and context management help a lot. These techniques have a lot of value for liveness (success rate, cost, etc), but are insufficient for safety. They're insufficient for safety for the same reason we're building agents in the first place: because they're flexible, adaptive, creative2 problem solvers. Traditional old-school workflows are great. They're cheap, predictable, deterministic, understandable, and well understo