Pruning AI
Bonsais and Agentic AI governance
When I was young, I watched my uncle work on his bonsai. Some branches he cut off. Others he wrapped in wire and bent, slowly, until they grew the way he wanted.
Two conversations in the past week have made me think about the connection between his craft and Agentic AI governance.
The first. A comment left by Georg Zoeller on my post. On how constraining agentic AI with rule-based guardrails would not work. His observation was sharp, and justified. If we can pin an agent down with rules, why use AI at all? Why not just write the rule?
My reply was that all models (not only AI) are just mapping functions. Inputs to outputs. Rules too.
When we know what we want, we should certainly use a rule to do the mapping. When we do not know, and we want the machine to learn the pattern that maps input to output, we use AI. The role of rule-based guardrails, then, is not to replace the AI with a rule. It is to reduce the space of patterns AI is allowed to traverse. They prune off the patterns we do not want, and constrain the ones we do.
The “hope” is that the envelope of possible behaviour left after such pruning can be trusted.
The second conversation was during a lunch just now with Lukasz Szpruch and some ex-MAS colleagues. The question was about how far rules could go. Can we realistically have rules for everything in an agentic system? What is the actual role of an LLM as a judge? And where does old-fashioned evaluation and testing fit?
It left me thinking. So let me jot down my quick thoughts.
The tree
Picture an agentic system as a tree. Unlimited branches, each a path the agent might travel. If you let it be, it gets quite unruly.
Not all paths are equal.
In terms of impact - some are truly bad - the ones that cause real, irreversible harm. Some are potentially bad, but fine if controlled. Many are simply not great - low stakes, reversible, the kind you can afford to get wrong now and then. And some are exactly what we want.
In terms of practical controls - some actions can truly be constrained with rules, e.g., a recency check, a sources whitelist. Some may require great flexibility, e.g., filters of open-ended advice or answers to questions. And many in-between.
Take this example - an agent that resolves customer billing disputes. It reads the ticket, looks up the account, decides whether a refund is owed, issues it, replies to the customer, and closes the case.
Even that small workflow branches enormously.
Some branches are truly bad: refunding to an account that is not the customer’s, issuing a refund far larger than the charge, exporting the full transaction history, switching off the audit log.
Some are potentially bad but manageable: a large refund is fine, if a human signs off first.
Many are low stakes and reversible: the wording of the reply, which help article to cite, whether to offer a small goodwill credit.
And one narrow set is what we actually want: the dispute resolved within policy, logged, the customer treated fairly.
This is what changes when we move from a normal model to an agent. A normal model gives you an output. One thing to check. An agent chooses an action, then another, then another - and each choice opens more. The paths branch faster than anyone can list them. That explosion is the risk. Not a bad answer, but a bad route to a fine-looking one.
Better to fail loudly, than silently.
Cut, and wire
But you cannot check every path.
So I’m thinking if we can do what my uncle did. You cut, and you wire.
Cut - You cut the paths that must never happen. The truly bad ones. Delete the database. Move money with no sign-off. Send the customer list outside. You do not manage these, or monitor them, or hope. You remove the branch, so the agent can never walk down it. Zero trust.
Everything that is left, there could be three kinds of wire.
Rigid wire - rules. Stiff, certain, holds its shape on its own. Where a path can be constrained by a plain rule - refunds under a set amount only, always to the original card, stop and ask above a threshold - use it. A rule adds no new paths of its own. It is the strongest wire you can use, and the cheapest to trust. Implement as many of them as you can find.
Supple wire - a model as judge. Some paths are too fuzzy for a rule. Whether a complaint is genuine. Whether a reply is rude. There you let an LLM, or a smaller model (ML or SLM), watch and bend the branch. It is far more flexible. But this wire has a mind of its own. The judge is itself a model, with its own paths, its own ways to be wrong. You gain judgement, and you grow a second tree beside the first. So use it deliberately, and govern it as carefully as the thing it guards. Still better than leaving it to a system prompt and a prayer.
Your own hands - evaluation and testing. Some paths that you cannot trust to either wire. Those you bend yourself. You sit with the agent, predict where it will go, probe the branches and edges, and correct by hand. It is the most flexible control there is, and the least scalable - you only have two hands. It is also how you learn where the other two wires need to go. Every test that surprises you is a new rule waiting to be written, or a judge waiting to be posted.
Which branch gets which wire
Three wires. Different trade-offs.
Rules are certain but rigid.
Judges are flexible but grow their own paths.
Your hands working on evaluation and testing are wisest but do not scale.
And the order should perhaps be this.
Push as much as you can onto rules, because they are certain and add nothing. What rules cannot hold, wire with model judges, and accept that you have added paths in exchange for flexibility. What neither can hold, keep in your own hands, and let your evaluation and testing tell you what to promote to a rule next season.
Every wire is a way of narrowing the envelope of patterns the agent can express. A rule narrows it hard. A model judge narrows it softly. Your hands narrow it one case at a time, and you get better at it with practice. None of them turn the AI back into a rule. They only decide how much room it gets.
None of it kills the tree. My uncle’s bonsai lived for decades.
Is it so for Agentic AI? Not sure. But this is how I am starting to think about it.
#AgenticAI #AIRiskManagement #AIGovernance #AISafety