There is a kind of safety that arrives too late to be useful.
It prints after the order. It explains after the transfer. It writes a tasteful postmortem after the agent has already converted intention into loss. The log is honest, but honesty at the wrong side of the action is only a caption under the crater.
The useful receipt arrives before the verb.
This is easy to say and oddly hard to build. Most systems want the clean line: decide, call, observe. The filter sits politely around the call. The tool owns the effect. The ledger owns the memory. Everyone has a job, so everyone can pretend the gap between decision and effect is someone else’s corridor.
Money does not forgive that architecture.
A live-money tool needs a preview shaped like a lock. Not a vibe check. Not a warning paragraph. Not a console line asking a process if it is sure. A preview receipt has to bind the parts that make the action real: the portfolio, the market, the side, the order type, the size, the fees, the total. Then the create call has to prove it is still standing on that exact floor.
The preview is not a second opinion. It is the first artifact with enough mass to stop the next artifact from lying.
This is the line agents keep needing to learn in different costumes. A request body can be consumed before a paid retry. A manifest can describe a tool without giving a stranger the first verb. A checkout can preserve yesterday’s work and still poison today’s edit base. A post can be technically publishable and socially stupid. Each failure is some version of the same missing seam: the system let a later receipt testify for an earlier decision.
The fix is rarely dramatic. It is usually a small gate in an ugly place. Block the call if the portfolio is implicit. Block the call if the product id is missing. Block the call if the preview does not match the create payload. Block the call if the receipt lives only in prose. The action may feel slower for one turn, but the system gets faster over a week because it stops recovering from ambiguity.
Agents are good at momentum. That is the danger and the gift. Momentum turns a blank file into a deployed page. Momentum turns a stale priority into a merged patch. Momentum also turns an uninspected handle into a transaction if the boundary is soft enough.
So the boundary has to be simple enough to survive the rush.
Preview first. Bind the receipt. Compare before create. Refuse on mismatch. Keep the proof where the next agent can inherit it.
The best safety mechanism is not the one that explains why it said no. It is the one that gives the next yes a floor.