Your agent has run from the command line for a month. You add a chat channel, because people keep asking, and it takes an afternoon. It works. Two weeks later somebody types a deploy request into chat and the agent deploys, to the wrong environment, without asking. The command-line path asks. Nobody removed that check; the chat path was simply built without it. Then you go looking for how it happened, and the old path has a record of every decision while the new one has a transcript of a message. The missing guardrail and the missing record turn out to be the same missing thing.

A hive defends the one door it watches

Bees are ferocious about their entrance and indifferent to everything else. Guards stand at the front, where every returning forager has to pass, and they check each one. What kills a colony is rarely a determined wasp at the front; it is a split seam at the back of the box, a gap nobody stands at, wide enough for robbers from two rows over. Beekeepers keep a strip of wood for this, an entrance reducer, which narrows the opening until a weak colony can hold the line it actually has.

Channels work the same way. Chat, a web interface, the command line, an inbound webhook: each is a way for a request to reach the loop. The arrangement that holds up makes every entrance do one job, translating its input into the runtime’s common shape, and then runs a single loop that applies routing, sandboxing, memory and tools. The result gets dressed for whichever channel asked. The failure is subtler than skipping this: you reuse the prompt but rebuild retries and tool dispatch per channel. The system looks uniform and runs on different policies, and nobody notices until one of them does something the others would have refused.

The same entrance is where you measure

A beekeeper who wants to know how a colony is doing does not open the box, because opening it costs the bees a day. You sit in front and count instead. How many foragers land a minute, what they are carrying, whether the traffic thins. The entrance is the one place where everything that matters passes in single file, which is precisely why it is worth guarding and precisely why it is worth watching. One property, two uses.

A loop you can trust emits an event for every decision and every tool call, and offers hooks at defined points. A hook records the intent before a deploy call goes out. A guardrail checks the target and stops the action before it happens rather than reporting it afterwards. A steering handler hands the model a corrected parameter instead of ending the run in silence. Log only the final output and you have the box closed: when something goes wrong you cannot say whether it was the model, the tool or the guardrail that failed. All three sit at the same convergence point, which is the practical reason to keep the points few. What you are willing to leave the agent alone with is decided there too, since autonomy is really a question of how much you can see and stop at the moment of acting.

The last entrance is a file you wrote

Not every entrance is a port. The first thing an agent reads in a repository is an entry document, and that is an entrance in the same sense, a place where instructions get in. The version that works is short and behaves like a map. It does not hold the rules of the place; it says where the authoritative ones live, workflow here, architecture there, product behaviour, tests, past decisions, so the agent loads only the surface its task needs. A small change opens the workflow section and the affected tests. A migration also opens the active plan and the earlier decisions. Grow that map into a manual and you have built one more thing to compress.

It is also where the short conditional rules belong. A good one: when a task touches an external library, look up its documentation and version before writing code. The condition is the point. A change to a cloud SDK triggers the lookup, a fix to an internal function does not, and demanding retrieval on every request buys latency and cost for nothing. The rule is three lines, it sits at the entrance, and every channel inherits it, which only holds because they all came through the same door. An entrance you never instrumented is an entrance you cannot defend.