Agents that act need a gate that says no

Agentic systems that only suggest are safe but useless. Agents that act are useful but dangerous. Drone operations need something that can schedule, inspect and alert on its own, yet can never launch, abort or escalate without a policy check and an operator’s explicit approval.

Shape of the system

A LangGraph supervisor loads persistent SQLite memory and routes each request to one of three specialists — planner, analyst, knowledge. Agents run a ReAct tool loop over Pydantic-validated Python functions: telemetry, weather, geofence, schedule, abort. Validation at the tool boundary means a malformed argument fails loudly before it touches anything real.

The knowledge agent answers from operator manuals and incident logs through hybrid retrieval — BM25 and dense embeddings fused with Reciprocal Rank Fusion — and cites what it used. The analyst reads aerial thermal frames with a vision-language model and falls back to a deterministic numpy hotspot detector; an alert’s severity has to be backed by imagery evidence.

The gate

Before any high-risk action, a safety gate applies hard policy checks — battery floor, wind limit, geofence, altitude ceiling — in plain code, not in a prompt. If the action survives the checks, the graph interrupts: state is persisted and nothing proceeds until a human approves via the API, the console or the CLI. Approval is first-class graph state, not a chat message the model is asked to wait for.

Determinism where it matters, language models where they help. Policy lives in code and is tested; the LLM plans, explains and retrieves.

Proving it keeps working

• Every LLM call, tool call, routing decision and verdict is traced to JSONL (LangSmith optional).
• A golden-set evaluation harness scores routing accuracy, tool-call accuracy, HITL gating and p50/p95 latency — and runs in CI.
• 17 offline tests, FastAPI service, Docker image, GitHub Actions.

The evals matter most for the gate itself. A regression that lets one high-risk action through unapproved is not a quality dip; it is the failure the whole system exists to prevent, so it is the first thing the suite checks.