Phase 5: Harden

Input: the spec's "worst plausible outcome", the design's tool surface. Output: enforced limits in code, and docs/agent-risks.md.

The premise of this phase: the model will eventually do the wrong thing. Not because it is badly built, but because it is a stochastic system handling adversarial and ambiguous input. So every protection that lives only in the prompt is a protection that fails on the day it matters.

The question to ask about each control: would this hold if the model actively tried to bypass it? If the answer is no, it is guidance, not a guardrail. Both are useful; only one is a control.

1. Enumerate irreversible actions

List every action the agent can take that cannot be undone: deletions, sends, payments, external API writes, deploys, permission changes, anything a third party observes.

For each: what is the worst outcome if it fires wrongly, and how would you find out?