For Agentic Workflows, the Safe Zone Is a Choice

A framework for deciding what work is safe to hand to an AI agent has been a topic of recent conversation.

On the Section blog, Michael Domanic, their Head of AI, published a piece walking AI leaders through how to decide what is safe to automate. He plots every candidate workflow on two axes: blast radius, meaning how much damage an error does, and reversibility, meaning how easily you can undo it. Low blast radius and high reversibility, automate freely. High blast radius and low reversibility, keep a human in the loop and review everything before it goes out.

Tian Pan, an engineer-founder writing for a technical audience about shipping agents in production, arrived basically at the same two axes from the opposite side of the house. He frames it as a pre-deployment exercise: inventory every tool the agent can call, ask what the worst case is, and classify it as reversible or irreversible. His conclusion about the dangerous tier is more pointed than Domanic’s. A system prompt instructing the model to behave is a reasoning expectation the model may not honor under unusual inputs. The control for high-stakes, irreversible actions has to be enforced outside the model, intercepting the action before execution, independent of what the model decided.

Two authors, two audiences, presented the same frame and conclusion: the dangerous quadrant needs a control that does not live inside the probabilistic system. When an AI-adoption advisor and a production engineer independently land in the same place at the same time, that is a trend and is worth taking seriously. 

It’s also worth finishing, because both of them stop one step short of the most important case for scale and competitiveness.

The irreversible action nobody classified

Pan’s reversibility test is about side effects. Deleting records is irreversible. Sending an email is irreversible. Charging a card is irreversible. Reading data is fine. The classification is built around what the tool does to the outside world.

By that test, a calculation might look completely safe. It does not delete anything. It does not send anything. It does not write to production or charge a customer. It returns a number. Nothing about it trips the irreversibility classification, so it might seem to be on the safe tier. It runs without a second look.

That is the gap. A wrong calculation is the silent irreversible action. It produces no error, no exception, no destructive side effect at the moment it happens. It simply produces a wrong number, which flows into the next step, and the next, and surfaces, if it surfaces at all, in a valuation that set a price, a ratio that cleared a loan, a model that shaped a term sheet. By then the decision is made. You can’t recall the calculation the way you recall an email, because nothing told you to. And by the time you find it, the arithmetic already drove conclusions several steps down the workflow.

Both frameworks route the highest-stakes, least-reversible work to human review. If you cannot detect the error at the point of computation, your only control is a person checking the work before it moves. And on multi-step quantitative work that person is slow, expensive, and not entirely reliable. People miss compounding rounding errors. They miss the assumption that silently became load-bearing four steps ago. Human review is the control you reach for when you have no better one. 

Pan’s own argument says so directly: the control has to be enforced outside the model. Human review is outside the model. But it is also subject to human error, and that error is most likely on exactly the work where it matters most: a wrong calculation three steps before the decision, buried in a chain a reviewer has to reconstruct by hand. Asking human checkers to back-validate multi-step math defers the failure rather than preventing it. Hardening the calculations themselves removes the load from the weakest link in the chain, and frees the expensive human up to focus on the highest value monitoring and decision making.

A different control

Change one thing: Suppose the calculation itself is deterministic, full-precision, version-locked, and carries a complete record of how every value was derived and where it came from. The same inputs always produce the same result. The result is checkable at the moment it is produced, not discovered three steps downstream. The provenance of every variable is explicit, so a wrong assumption is visible rather than buried.

The blast radius has not changed. A wrong valuation still does the same damage. What has changed is the part of reversibility that matters: the error is now less likely to happen. If it does, it is catchable before it propagates and traceable when it does. The work moves out of the quadrant where your only control is a slow, expensive human and into the one where you can automate, observe, and intervene with confidence, because now there is something specific to observe and a precise place to intervene. It is exactly the architecture Pan prescribes for destructive tools, applied to the irreversible action his classification missed: a deterministic layer outside the model, enforcing correctness independent of what the model reasoned.

The safe zone, then, is not fixed terrain. 

It is a function of the controls you put in place. With a weak control, the zone is small and most of your valuable quantitative work sits outside it under permanent manual review. With a strong one, the same regulatory lines, the same reputational stakes, the same hard perimeter, but far more of the work inside that perimeter can run without a resource-intensive person re-checking the arithmetic.

This is a competitive variable, not a compliance one

Two firms operate under the same regulations. Same exposure if a number is wrong. Same reputational geography, none of it negotiable.

One treats the manual-review tax as a permanent cost of operating in that geography. Every consequential calculation gets a human pass because that is the only control available. The other adopts an execution layer that makes the calculation deterministic and auditable, and now safely automates quantitative work the first firm still pays a human to babysit.

The second firm is taking the same risk as the first, just with a better instrument. The regulatory or reputational boundary has not moved. It is operating confidently in more of the space inside the boundary than its competitor can. On exactly the high-value, calculation-dense work where the manual-review tax is heaviest, it is structurally faster and structurally cheaper.

That is a story about who gets to move faster and more confidently. The second firm’s boldness is not an appetite for danger. It is the willingness to adopt new infrastructure to work at speed inside hard lines that their competitors treat as a reason to slow everything down.

The honest scope of this

This control collapses one specific failure mode, not all of them. It removes the math-execution error from the irreversibility calculation. It does not remove the risk that the model misreads what you asked, or that you fed it the wrong inputs, or that the wrong model was selected for the job. Those still live in the unsafe quadrant and still need their own controls, the kind Pan and Domanic describe.

But the math-execution failure mode is large, it is currently uncontrolled in most agentic workflows, and it is the one both frameworks can currently only answer with a human. Probabilistic systems do not produce deterministic results, and they do not get there with scale. IBM’s financial-services research showed frontier models, at their most deterministic setting, reproducing the same financial calculation only 12.5% of the time across repeated runs, with larger models no more consistent than smaller ones. This is an architectural boundary, not a capability gap the next point release of a model closes. The control for it has to be deterministic by construction. Nothing probabilistic will do the job.

A separate, purpose-built execution layer is what that control looks like. The reasoning model interprets intent. A deterministic engine executes the math, at full precision, against version-locked logic, with the provenance to prove how the answer was reached. That separation is what moves consequential calculation out of the quadrant where a human is your only safeguard.

TrueMath is that layer. 

Two independent observers, in the same timeframe, told the market the dangerous quadrant needs a control that lives outside the model. They were right, and they were describing infrastructure that already exists for the one action neither of them thought to classify. The firms that understand the safe zone is a choice are already operating where their competitors will not.

Reach out: bill.kelly@truemath.ai
Learn more: truemath.ai
Sign up for early access: https://app.truemath.ai/signup