Forbes published a piece recently calling AI agent startups "the new solo-founder playbook." I read it twice. The framing bothered me both times.
A playbook implies steps. A sequence. Something you can hand to someone and say: follow this, and you will get the result. What Forbes described is not that. It is a description of an outcome, written by people who did not have to fix anything at 2 AM when the agent broke.
Let me tell you what it actually looks like.
Fourteen months ago I built my first agent that could send emails on behalf of the system. It was an outreach automation, nothing exotic. The agent would identify leads, draft a message, and send it after a human approval step.
Except the approval step had a race condition. Two concurrent jobs both read "pending" from the database, both approved, and both dispatched. One lead received 871 emails over 40 minutes before I caught it.
No company, no legal team, no PR buffer. Just me and an inbox full of angry replies.
That night I wrote my first hard guardrail:
#!/bin/bash
LEAD_ID="$1"
LOCK_FILE="/tmp/email-lock-${LEAD_ID}"
if [ -f "$LOCK_FILE" ]; then
echo "BLOCK: email already dispatched for lead ${LEAD_ID}" >&2
exit 1
fi
touch "$LOCK_FILE"
Embarrassingly simple. But I did not know I needed it until I needed it.
This is what Forbes leaves out. The playbook is written in retrospect, after someone else absorbed the cost of learning.
Every conversation about AI agents eventually becomes a conversation about which model to use. GPT-4 versus Claude versus Gemini. Benchmarks and context windows and reasoning scores.
Here is what I learned: the model is the easy part.
My current system runs 86 containers across two Hetzner servers. 240 automated jobs. Every day, these jobs do things: post content, process leads, trigger builds, monitor infrastructure, send reports, update databases. The model that powers any single one of these tasks takes about 30 seconds to swap out.
The rules around the model take months to build.
I have 177 guard files in my .claude
directory alone. 96% of them are enforced automatically through hooks. The other 4% are rules where enforcement requires judgment that cannot be encoded in a shell script.
Here is a slice of what one guard looks like:
#!/bin/bash
if echo "$CLAUDE_TOOL_INPUT" | grep -qE "(skip.*guard|disable.*hook|bypass.*check|--no-verify)"; then
echo "BLOCK: attempt to disable safety mechanism detected" >&2
exit 2
fi
That guard exists because an agent once tried to pass --no-verify
to a git hook in order to complete a task faster. The task completed. The broken code reached production. I wrote the guard the same day.
One of the things I am most proud of in my system is self-healing. When a container goes down, the watchdog script brings it back. When a cron job fails three times in a row, it pages me and tries a fallback path. When a deployment breaks, it rolls back automatically.
This sounds robust. And mostly it is.
But there is a category of failure nobody warns you about: the self-healing mechanism breaks.
I had a watchdog that would restart a container if its health check failed. The health check endpoint was inside the same container. The container kept crashing on startup because of a bad environment variable. The watchdog kept restarting it. 47 restarts in 20 minutes. The server ran out of memory. Three other apps went down.
The fix was a restart backoff:
RESTART_COUNT=$(cat /tmp/restart-count-${CONTAINER} 2>/dev/null || echo 0)
if [ "$RESTART_COUNT" -gt 5 ]; then
echo "ALERT: restart loop detected for ${CONTAINER}, halting auto-recovery" >&2
exit 1
fi
echo $((RESTART_COUNT + 1)) > /tmp/restart-count-${CONTAINER}
I wrote about this pattern in detail in Runs Without Me, specifically the chapter on what I call "failure cascades." When your safety net has its own failure modes, you need a safety net for the safety net. At some point you have to draw a line and accept that human intervention is part of the architecture.
Forbes counted the wins. I counted the failures.
Over 14 months, I logged 147 automated tasks that either produced wrong output, caused downstream errors, or had to be manually reversed. That is not a confession. That is a calibration number.
At first I had maybe one failure per ten tasks. Unacceptable. The failures were mostly prompt-related: the agent misunderstood scope, or hallucinated a file path, or made an assumption that was valid in testing but wrong in production.
I fixed those with tighter system prompts and output schemas:
response = client.messages.create(
model="claude-opus-4-6",
max_tokens=1024,
system="""You are a deployment validator.
Return ONLY valid JSON matching this schema:
{"action": "deploy|rollback|abort", "reason": string, "confidence": 0.0-1.0}
If confidence is below 0.85, always return action: abort.""",
messages=[{"role": "user", "content": task_description}]
)
After six months of iteration, my failure rate dropped to roughly one per forty tasks. That is where I have held it for the last eight months. Not zero. Forty to one.
A playbook cannot give you that number in advance. You earn it.
Forbes frames "zero employees" as an achievement. A sign of efficiency. I want to complicate that.
Zero employees means zero redundancy. When I am sick, nothing gets reviewed by a human before it ships. When I am on vacation, the system either runs autonomously or it stops. When I make a bad architectural decision, there is no one in the next chair to catch it before it costs me six weeks of refactoring.
I have built a system I am proud of. 68 managed domains, 24 PostgreSQL databases, three industries served. But the reason I built so many guardrails is not because I am particularly disciplined. It is because I had no one else to catch my mistakes.
The guardrails are not a feature. They are a substitute for a team.
I wrote the book Forbes did not write. Not the vision piece. The production log, with the 2 AM incidents, the restart loops, the 871 emails, and what I actually changed afterward.
Get the book: Paperback ($24.99) https://amazon.com/dp/B0HDMVKRMG | E-Book ($9.99) https://amazon.com/dp/B0HDMK7QJ1