September 2026
Over the last two weeks I built a working SaaS product with AI agents doing most of the typing. That part isn't interesting anymore. Everyone has that post.
What I haven't seen anyone show is what it takes to make agent output safe to merge, and what happens when you actually enforce it.
The project is frontdesk, an AI request desk for small businesses. A customer submits a question through a public form. The system classifies it, retrieves the business's own documents, and drafts a reply with citations. A human approves, edits, or rejects it. Nothing reaches a customer without that human step.
It's live at frontdesk.jtrent.dev and the repo is public, so every number below is checkable.
That last line is the one I'd want to be asked about in an interview.
Every PR carries a required label naming who wrote it and a Model: line naming which model. CI rejects the PR if either is missing or ambiguous. Provenance is a gate here, not a convention people are supposed to remember.
Then a review agent reads every diff against a written rubric: tenancy, secrets, architectural drift, whether the PR contradicts a decision record. A finding marked blocking fails a required check. No agent can merge. Only I can.
PR #92 hit that wall seven times. One finding was that the code named a specific cloud vendor inside a layer where a decision record had explicitly said vendor names don't belong. That's exactly what a human reviewer skimming a green diff at 11pm lets through.
Yesterday it blocked me. Twice.
I'd changed a mechanism a decision record had decided on, and recorded the change by editing that record in place. The repo's own docs say superseding a decision means a new file, never edit a decided one. I wrote that rule. I broke it anyway. The reviewer quoted my own line back at me and refused the merge until I wrote the superseding record properly.
That's the part I'd defend hardest. Anyone can point an AI at a diff. What was worth building is the thing that held when the person breaking the rules was me.
Prompt and retrieval changes run against 20 labeled requests before they can merge. Classification accuracy, recall@5, recall@1. None may drop below a committed baseline, and only a human-labeled PR can raise that baseline, so an agent can't move its own goalposts.
The first time it ran, accuracy came back at 0.20.
That wasn't a regression, it was a live bug. The model was wrapping its JSON in a markdown code fence, the parser didn't strip it, and four out of five classifications were failing silently. In production. The demo looked fine because the fallback path was doing something reasonable.
Two weeks of manual testing hadn't found it. The first automated run did, in about a minute.
Every six hours, an agent reads production. Prometheus alerts, error-shaped log lines, pod restarts, failed jobs. It does this through a Kubernetes service account that cannot create, patch, exec, or read secrets. I've verified each of those returns no. It has exactly one write capability: open a GitHub issue, with quoted evidence, a hypothesis, a proposed fix, and a confidence level.
It cannot fix anything, on purpose. I don't want a thing that restarts deployments at 3am while I'm asleep. I want a thing that tells me what it saw, with the log lines attached, so I can decide at 7am whether it mattered.
Its instructions live in the repo, so changing what the agent is allowed to do is a pull request that gets reviewed like any other.
$0.0053 per triaged request. $6.49/month for the node. The whole thing runs on one small server.
I priced the alternative: below roughly 6,600 requests a month, renting tokens beats the cheapest box that can run a model locally. Above that, owning the hardware wins. The cost table is in the README with the arithmetic shown, because "it's cheap" isn't an architecture argument and I'd rather be corrected on numbers than believed on adjectives.
The models are good enough. That's not where the difficulty lives. An agent will confidently do something reasonable-looking that violates a decision you made three weeks ago and forgot you made, and it will do it in a diff that passes every test.
Most of the effort, then, goes into machinery that makes that violation impossible to merge. Decisions written down where agents read them. Provenance that can't be omitted. A reviewer with a rubric and the authority to say no. An eval gate an agent can't move. A human on the merge button.
Five of those six were enforcing before I wrote this. The sixth, the ops agent, went live this week.
The repo is public, including the pull requests where the guardrails blocked me. Those are the ones worth reading.
github.com/jason-trentcyber/frontdesk-intake · live at frontdesk.jtrent.dev
I'm Jason Trent. 20 years building production software, most recently as an architect on a healthcare platform serving 150+ hospitals. I'm looking for AI architecture work, the kind where somebody has to decide what agents are allowed to touch. If that's a problem you have, I'd like to talk.
jason@jtrent.dev →