01

Autonomous
isn't unlimited.

AI agents now work inside five of my apps. Each one acts on its own, and none of them is me. Warden is the console I built to decide what each agent may do, hold anything that commits me until I say yes, record every decision with its reason, and stop any agent at once — in the real app, not just on a dashboard.

AI agents work inside five of my apps, and none of them is me. Warden decides what each may do, holds anything that commits me until I say yes, records every decision with its reason, and can stop any of them in the real app.

Product, design and architecture — end to endWarden · the console for my AI agentsBuilt by directing AI agents · a web app and an iPhone app
What it governs
24 agents · 5 of my apps
What it decides
Allowed · needs approval · blocked — with the reason
Status
My daily console · live demo on sample data
The live demo (labeled sample data, nothing real)The story: who's watching the agents?

The queue: what my agents are waiting on.

The public demo, on sample data.

It started as curiosity.

Agents were the part of AI I'd kept my distance from.

I was so scared of AI agents and felt it was out of my reach. But it's so fun.Me, on why I started

Warden began as a way to explore guardrails and permissions for AI agents. Then Google Analytics' interface didn't fit what I needed for my own sites, so I built analytics into it. Then my apps grew real agents — the chatbot on this portfolio, Finance Chief's transaction categorizer, Inkwell's writing assistant — and Warden became the place that governs them. I started it to test the waters for a potential Datadog interview. Then the problem got more interesting than the interview, and I couldn't stop.

I set the principle
before the permissions.

An agent is not its owner. Its authority is designed around rules a person sets: by the task, how confidential it is, its impact, and how much attention to detail it needs. Anything out of scope or ambiguous comes back to the person. It acts on its own only where someone said it may, inside guardrails.

Its own keys, and nothing else.

Every agent gets its own scope. Anything not granted is denied by default.

Five gates,
always in the same order.

Every action an agent attempts passes the same five checks: is the agent switched on, does its owner have the authority, is it inside its scope, does a guardrail say stop, and how much may it do on its own. Autonomy is checked last, so trust can never widen what an agent may touch. One pure function returns the verdict and the reason at every gate, and the same engine is the decision point a live agent calls before it acts.

Every action passes five checks in a fixed order, and autonomy comes last, so trust can never widen what an agent may touch. The same engine is the decision point a live agent calls before it acts.

On whose authority? Every verdict says.

A held transaction, opened: its facts, the gate that held it, and my call.

Two kinds of hold,
two kinds of answer.

A held action first offered only Approve and Deny. Agents ask two different things. A permission question — may I send this? — takes a yes or no. A knowledge question — what is this $500? — needs the answer. Approving it would only tell the agent to guess. So a knowledge hold takes my answer instead, and I can make it a standing rule so the agent never asks about that again.

A permission question takes a yes or no. A knowledge question needs the answer, so a knowledge hold takes mine, and can make it a standing rule.

Looking at a held transaction that only offered Approve and Deny:

What exactly am I approving?Me, in the console

An agent asks, I answer, my app acts.

Finance Chief's categorizer files transactions by my rules on its own. When one matches no rule, it holds it in Warden. I type what it is. Warden hands my answer back to Finance Chief, which files the transaction, writes the standing rule if I asked for one, and reports back in Warden.

A pause that stops
the real app.

Warden governs cooperating agents: each app asks before it acts and obeys the answer. The chatbot on this portfolio asks before every free-form answer. Pause it in Warden and it stops answering within seconds. The page stays up; only the AI stops. When I paused an agent in Warden, my real Finance Chief app stopped too.

Each app asks Warden before it acts and obeys the answer. Pause the chatbot on this portfolio in Warden and it stops answering within seconds; pause a Finance Chief agent and the real app stops too.

What commits me waits for me. My job-search agents find, log and draft on their own. Anything that commits me — a send, a submission — is held for my yes on the exact text. My yes inside the Job Search app counts as Warden's yes for that one send, and when Warden can't be reached, the send waits instead of going.

Every agent says what it did. After an allowed action, the agent reports one plain line — what it actually did — onto its own decision in the audit log. Warden sees what each agent asked for and what it then did.

And it watches.

Warden also measures what the agents cost and who my sites serve: AI spend per agent and per app, totaled once a day by an agent of its own; first-party visitor analytics with no third-party trackers; and uptime for every app. The view I'm proudest of is the chatbot's questions — what visitors actually ask.

It also measures AI spend per agent, first-party visitor analytics with no trackers, and uptime. The view I'm proudest of: what visitors actually ask the chatbot.

Then I made
every agent real.

A governance console is only as honest as its roster. I checked every agent against Warden's own records: which ones had really asked for permission, which were wired but idle, and which existed only for the demo. The spend tracker became a real daily run that asks Warden first, like any other agent. Today every agent in the roster belongs to a real app. The only simulated activity left is the public demo's, labeled as sample data.

I checked every agent against Warden's own records, and made the last placeholder real. Every agent in the roster now belongs to a real app; only the public demo runs on labeled sample data.

Reviewing the roster, after the audit:

All the simulated ones are gone, right? If not, let's make them real.Me, to the AI builder

A console you read
at a glance.

The first design was a dark console that drew every line it could. I rebuilt its design system around one rule: colour means a verdict and nothing else. Allowed, needs approval and blocked each carry a colour and a shape, so state reads before words. Everything else is ink on a warm off-white, separated by space and tone, with no borders and no shadows. A queue is grouped under its verdict, so the tiles themselves stay plain, and a held action is a short brief that opens to its facts, the five gates, and my call. I picked it from three rounds of interactive prototypes, down to the typeface.

I rebuilt the design system around one rule: colour means a verdict and nothing else. Ink on a warm off-white, no borders, no shadows, and a queue grouped under its verdict.

What I asked the redesign for:

I don't like rows. I like tiles. I like brief descriptions. I like clear buttons.Me, to the AI builder

First deployed
the day I started it.

Warden was first deployed the same day as its first commit. It's where I check on my sites and my agents, on the web and on my phone. The public version is a live demo: the whole console, populated with clearly labeled sample data, so nothing real ever ships.

First deployed the day I started it. The public version is a live demo on labeled sample data.

First commit to first deploySame day
Commits150+
Automated tests, all passing290+
Agents governed24 across 5 apps
Real decisions on record200+
The software's own scale, from its git history, test suite and decision log (October 2026).

Watching isn't
the same as deciding.

5gates every action passes, autonomy last
2kinds of hold: a yes or no, or an answer
1pause that reaches the real app

How much authority is enough.

Still in progressThe right amount of authority

I'm still working out how much authority each agent should have — what it should do, and what it shouldn't — and how Warden should tell me when something needs me.

What it left behindA way of building

Set the principle before the permissions. Give every agent its own keys. Check trust last. Match the control to the question. Make the off switch reach the real app. Record who decided, and why.

The agents act on their own.
I still decide what they may do.

The point

Warden was never a dashboard. It was a decision — set an agent's authority before its permissions — an architecture — one engine every agent must ask, with a pause that reaches the real app — and a negotiation — agents that act on their own, inside rules I set.

Part of the Build Lab, the tools I build for myself. Try the live demo on labeled sample data.

Keep exploringThe Build LabThe tools I build for myself