# Guardrails and journaling

> The funnels, validation and locks every agent write shares, and the trail each action leaves behind.

An agent is not a second way into the station. Every call lands in the same code the
pages call, under the same locks, and leaves the same trail an operator's action would.

## Guardrails every write shares {#guardrails-every-write-shares}

- **Same funnels as the UI.** Configuration writes go through the same provisioning and
  use-case services as the pages, live writes ride the single logic queue, and run
  control rides the Process lifecycle. There is no parallel path an agent could use to
  bypass validation, locks or journaling.
- **Editor-grade validation.** Upserts merge the supplied parameters over the existing
  declaration and validate the merged draft with the same rules the editors apply. A
  refused upsert leaves nothing half-applied.
- **The engineering lock applies.** While a Process unit is running, configuration
  changes are refused with a structured "Configuration is locked while a Unit is
  running" result naming what to finish first, exactly as the pages refuse them.
- **A stopped runtime is read-only.** When the station runtime is stopped, only
  inspection, status, listing, report export, the backup snapshot and UI orientation
  (`ui_state`, `ui_navigate`, `ui_screenshot`, `ui_scroll`) keep working; every mutating
  call answers `Runtime stopped` even if its area toggle is on. Tools added in the
  future fail closed until deliberately classified as read-only.
- **Destructive tools are flagged.** Tools that command equipment or destroy data
  (`tag_write`, `action_run`, `process_recipe_apply`, `process_start`, `process_resume`,
  deletes, `server_stop`, …) carry
  the MCP destructive flag, so clients that auto-approve safe tools still ask before
  these.

## How agent actions journal {#how-agent-actions-journal}

Everything an agent does leaves the same trail an operator's actions do, in the places
you already look:

- The endpoint's lifecycle, every agent-side configuration change and every refused
  browser probe journal under the **Agent** area of the [Events](events) Console
  (`logs_read` filters on it directly).
- Live operations on the logic queue (variable writes, tag writes, action runs, alarm
  acknowledges) journal with origin **MCP**, beside the same operations done from the
  UI.
- Runs an agent starts, stops, aborts or comments record **Agent** as the actor in the
  run file and in [Histories](histories), so a person's name is never put on something
  they did not do.
- The persistent event history is append-only for agents: `event_history_read` cannot
  clear or delete anything.