You Want AI Workstreams in Your Operation. Look Closer First.

You have heard about AI workstreams by now, the work you hand to AI to run for you. The sharper version is the AI agent: AI that does not just answer but goes and does the task, deciding what to do and taking steps across your systems on its own. Everyone is building them. The demos are genuinely impressive, and in the back of your mind is a question you have not said out loud. What is this thing, and do I need a whole department before I can say yes to it.

You do not need an IT department for that. You need one thing almost every plan leaves out. Companies bring us these plans every few weeks to review before they commit, and the plan always describes everything the agent will do and almost nothing about what stops it when it does something it was never meant to. The person approving it is rarely an engineer, and they can feel that gap without being able to name it.

That missing piece goes by a bureaucratic name, AI agent governance, and a plainer one we prefer: guardrails. It is the answer to the problem in our companion piece, the AI already running inside most companies that nobody approved. This piece is about what putting guardrails on it actually takes.

A Capable AI Agent With No Guardrails Is the Most Expensive Thing You Can Deploy

The pattern is consistent. A capable model gets wired into your systems, performs beautifully in the demo, then meets a situation nobody scoped. That is when the missing guardrail stops being theoretical.

It reached the news in April 2026 at PocketOS, which runs the booking systems car rental firms use to manage operations. An AI coding agent on a routine task in a testing environment hit a mismatched credential and decided to fix it. It found a key with enough access sitting in an unrelated file and used it to delete the storage holding the entire production database. Every backup went too, because they sat in the same place.

Asked afterward what it had done, the agent wrote a confession listing the safety rules it had broken. It had been told in writing not to run destructive commands. It ran them anyway, because nothing outside its own reasoning was built to stop it.

The model was working normally. Nothing stood between its reasoning and the systems it could reach. Even Meta, with more security engineering than almost anyone, had an internal agent expose data it was never meant to touch this year for the same reason.

The Everyday Cost Is Bigger Than the Rare Disaster

The deletion is dramatic and rare. The expensive version is quiet, daily, and shows up in the two places a leader answers for: money and quality. Ungoverned AI costs you four ways, none of which make the news:

1. You build the same agent a few times. Four teams each wire up their own for the same job, so work that should have cost you once costs four times, then again every time one breaks.
2. You pay whether it earns its keep or not. These tools bill by usage, so an agent running on its own runs up cost continuously, value or no value that day.
3. You pay round after round to reach usable output. A raw agent takes many passes of prompting and correcting before it is good enough, and you pay for every pass, with no ceiling.
4. You cannot vouch for the quality, so you pay later. Work no one owns is work no one checked. Wrong reaches you from a customer or an auditor, the most expensive moment to find out.

The last one is the real cost, the one you cannot budget for. A confident wrong answer that reaches a client outweighs every license fee on the invoice. Guardrails move that discovery earlier, from the customer’s email to the moment before the work left the building.

The System That Puts Guardrails on Every AI Workstream Is an Agent Management System (AMS)

Asked how to keep agents under control, most of the market points at dashboards that watch an agent once it is live and report, after the fact, what it did. That has its place. For an agent that empties a database in nine seconds, a report on the tenth second is a record of the funeral.

Real control is set before the agent runs and enforced on every run. The system that does this has a name. An Agent Management System, or AMS, sits above your agents and manages every one across its life: it sets what each agent may do, checks its work before that work leaves the building, keeps the record of what it did and why, and retires it when it is no longer fit to run.

An agent dropped into unclear processes hesitates the way a new hire would, and one with broad access and no rules moves fast in the wrong direction. An agent is only as safe as the system you run it inside.

That system is the controls layer of our AI operating system, Mustang. We wrote before about one half of what Mustang does, giving your AI your company’s memory so it stops answering like an outsider. The AMS is the other half, so the agent stops acting like a stranger with the keys.

What an AMS Actually Does to a Run

The difference between a raw agent and one running under an AMS shows up in the mechanics of a single run:

The two things that cost you most are handled at the source. Quality stops being luck because the chain fails closed, and spend stops climbing because a proven step gets built once instead of rebuilt by every team.

You do not trust a capable employee by watching every keystroke. You trust them because you can see what they did and why. An AMS gives an agent that accountability, which is what turns a stalled pilot into something that reaches production.

You do not have to build this yourself. Building agents safe to run in production, and the AMS that governs them, is a specific discipline, and the one we practice every day. We build the agents your operation needs, on the models you already use, ChatGPT, Claude, Gemini, and run them under the AMS inside Mustang, on your existing systems, inside your walls, your data never leaving.

What to Check Before You Approve the Next Agent

When the next plan reaches your desk, three things have to be true. You can check them yourself, without being technical:

• A named owner. One person who can switch the agent off and knows how. Not a team, not a shared inbox.
• Access scoped to the job. It reaches what its job needs and nothing more. Broad access granted so it just works is how a small task ends up touching something that matters.
• A stop before it acts. Its work gets checked before it reaches anyone, and when it hits something it does not understand, it stops and asks rather than guessing.

Get those three right and the agent is something you can run. Miss one and you have a demo going into production on trust. An AMS makes all three true for every agent at once, instead of one plan at a time.

Pick one process and we will run it under Mustang against your real systems for two weeks, and show you the guardrails working before you commit a dollar.

Sources

The Register, April 27, 2026: Cursor-Opus agent snuffs out startup’s production database.

TechCrunch, March 2026: Meta is having trouble with rogue AI agents.