Prompt-level guardrails vs execution-level controlInstructions to a model are advice, and advice can be argued around. A new employee told never to approve refunds over a set amount can still be talked into it by a convincing story. A payments system that rejects those refunds cannot be talked into anything. The control that holds sits below the model, at the point where an action executes: each call is checked against permissions, current state and rules before it runs, whatever the model was told.
WEM No-Code builds on this idea: the agent reasons, and the platform decides. It names four properties: a deterministic core, where workflows decide the path rather than the model; scoped access, with state and permissions held outside the language model; pre-execution validation of every step; and a full audit trail, with every decision logged and replayable. A
simulation on its product page shows the principle: a support agent is talked into requesting a refund, and the platform refuses the call because the order was never paid, the account is not the payment method on file and the order is not in this session. The page notes that real attacks are far more elaborate. See the
product page and the
governance and security page.
Human-in-the-loop is a design choiceHuman oversight is not a switch. A person can approve every action, only the exceptions, only actions above a value or risk threshold, or review samples afterward. The right pattern depends on what a wrong action costs and how reversible it is. Decide it per process. The guide to
human-in-the-loop governance sets out five patterns and how to choose between them.
What an audit trail has to captureReconstructing a decision later means recording more than the outcome. A useful trail captures the request that triggered the work, the data the agent read, the action the model proposed, the call that actually ran, the validation result, any human approval or override, and the timestamps and versions involved. The test is replay: can someone who was not there see what happened and why? The
audit trail requirements guide covers what regulators expect.