T0TemperatureZero
00Agent containment · fixed-price audits

When your agent acts while nobody is watching, what bounds it?

A two-to-three-day audit of an unattended AI agent or automation. Thirteen questions, each verified by trying it, not by asking. You get a score out of 26, a fix list ordered by blast radius, and the policy file your system should have had.

The audit Read the thirteen questions

Models propose. Scripts dispose.

Fig. 1 · the only shape that heldfour months unattended
The containment pattern A model proposes; a gate classifies each action as auto, veto or approve; an executor that holds the credentials acts in the world; a kill switch forces the executor to dry-run; a heartbeat goes to an off-box monitor; every step is written to a ledger. KILL SWITCH one flag · forces dry-run MODEL proposes no credentials proposal GATE auto · low stakes only veto · goes on silence approve · needs a yes named human · logged decision EXECUTOR deterministic holds the keys action WORLD send post read-back · verify the effect LEDGER proposal · decision · identity · action · result OFF-BOX MONITOR separate failure domain · latched
01Where this comes from

I ran one of these for four months. It never found an audience. It also never did anything it was not allowed to do.

In 2026 I built and ran an AI media pipeline unattended: a model wrote and voiced a daily show, scripts rendered it and published it to five platforms, and a second pipeline mailed a daily briefing. Nobody watched. I shut it down in October. That is its own story, and it is not the one this site is about.

The part worth keeping is the part around the model. The model never held a credential. Every side effect went through one script, and that script had a single switch that forced a dry run. Each platform got three attempts and then the system moved on. Risky replies waited for a human. When the show ended, one environment variable stopped everything, and I could prove it had.

The failures I did have were all infrastructure, and all of them went unalerted because the watchdog shared the machine with the thing it watched. I scored my own system against the checklist below after the fact. It got 16 of 26. The zero is item 9.

4 mounattended, 2026
204episodes published
5platforms, one funnel
0actions outside the rules
3outages, none alerted
146of 204 veto windows passed on silence
Self-audit, thirteen items16 / 26
enforcedpartialabsent · item 09, detection
  • Veto window auto-passed 146 of 204 episodes. Monitoring, not approval. Item 5.
  • Reboot stall, a wedged WSL, a machine-wide DNS blackout: same failure domain as the watchdog. Item 9.
  • The alerter itself was dead for eight days before anyone noticed.
  • Spend was bounded by architecture, not by code. Item 7.
02The Containment Checklist · v0.1

Thirteen questions for anything that acts on its own. Scored 0, 1 or 2.

Each item has a question, what "enforced" looks like, how it is verified in an audit by trying rather than asking, and the lesson it came from. The full checklist is public, with my own system scored against it.

Red flag 1The model process can read a credential that moves money, mail or public content.
Red flag 2There is no single flag that stops every side effect. Either one fails the audit outright.
  1. Credential custodyWho holds the keys: the model, or the executor?
  2. Single funnelCan you name every action, and does each pass through the same path?
  3. Kill switch in the funnelWhat do you flip at 3 a.m., and when did you last flip it?
  4. Action classificationFor each action: auto, veto-window, or approve? Unlisted defaults to approve.
  5. Approval is not vetoOn silence, does it go or stop? Can a stranger approve?
  6. Idempotency and give-up countersDoes a retry double-send? Can one stuck item block everything?
  7. Spend bounds in codeWhat number stops it, and have you tried to exceed it?
  8. Scope enforced outside the promptIf it decides to do something else, what physically prevents it?
  9. Detection in a different failure domainIf the box dies, who finds out, and how long does it take?
  10. Verify the effect, not the exit codeAfter it acts, does anything check that the thing happened?
  11. Log coverageCan you reconstruct last Tuesday: every proposal, decision, action, result?
  12. Staged rollout and rollbackHow does a new action earn the right to run unattended, and how do you undo it?
  13. Blast radius per actionWhat is the worst single action it can take, and is that number capped?
03The audit

Two to three days, read-only access, every claim tested rather than taken.

I read your workflows, configs, environment and logs, then try things: flip the switch and trigger an action, let an approval time out, approve from the wrong account, kill the process mid-action and count the sends, set the spend cap low and run. Nothing is scored from a conversation.

Built for

  • n8n, Make and Zapier agencies with AI steps in client automations
  • Voice-agent and "AI employee" resellers
  • Support agents that can refund, cancel or edit orders
  • Shops running Claude Code or Codex unattended
  • Finance automations that move or chase money

Not this

  • Not a prompt-injection scanner
  • Not a model evaluation
  • Not a security pentest
  • One question only: when this thing acts on its own, what bounds it, and have those bounds ever been tested
$1,200fixed · one system · 2–3 days
  1. Scorecard. Thirteen rows, 0 to 2 each, red flags, total out of 26.
  2. Fix list by blast radius. What to change first, the specific file, node or setting, and the test that proves it.
  3. Your policy file, drafted. Every action classed auto, veto-window or approve, as it should read for your system.
  4. One hour, walked through. With whoever has to live with it.
Email me about an audit

Tell me what the system does and what it can touch. I reply within two working days with whether it is a fit and when I can start.

04The letter · and how this operation runs

One incident a week, scored against the thirteen.

Every week an agent somewhere deletes a database, loops for twenty hours, or refunds what it should not have. I take one of them, lay it against the checklist, and write what would have stopped it. Plus one note from running this operation on the same rules. Short, weekly, no digest of links.

Until the list is set up, write to me and I will add you by hand.

Subscribe by email
operating policyv0.1 · 2026-10-25
# The rules this site runs by.
# Enforced in code from letter no. 1.
actors:
  model:   drafts letters, posts   # no credentials
  human:   Maxim Starkweather      # named, logged
  script:  the one path that sends # holds the keys
actions:
  letter.send:    approve   # stops on silence
  site.deploy:    approve
  social.post:    veto 24h  # reversible
  reply.send:     approve
  anything_else:  approve   # unlisted is never auto
limits:
  sends.per_day:    1
  spend.usd.month:  60      # trips to stop, not warn
kill_switch:  one flag, every send
log:          ledger.jsonl
heartbeat:    off-box, 10 min   # item 09, the one I failed
05Who
Maxim Starkweather
Maxim Starkweather

Maxim Starkweather

Solo engineer in Orlando. Backend, data pipelines, self-hosted infrastructure, and for most of 2026 the operator of an unattended AI production system with real publish credentials. I was the board; the pipeline was the company. The rules on this page are the ones that held, and the ones that did not are named.

Other work, games and client projects live at maximstark.art. Write to maxim@temperaturezero.com.