The real cost of constantly rebuilding the same safety baseline

October 28, 2026

When an engineering team builds a new AI agent to handle customer communications, it needs proper controls, like PII masking, audit logging, and a way to show an auditor how customer data is handled.

Introducing safety controls to determine what the agent can and can’t do is important, because an agent that’s confidently wrong or exposes sensitive information in a live customer interaction is a failure that also exposes the brand. But doing the same work over and over for every new agent and channel isn’t what engineering teams should be spending most of their time on.

Yet 84% report spending at least half their time on guardrails and safety controls, and 35% spend most of it there. Chances are these controls have already been built for the last agent, and will be built again for the next, just by default.

Masking your customers’ card numbers in AI conversations is the same job in every agent. Whether it handles a failed payment or a subscription renewal, over WhatsApp or email, their full card number should never appear in the message. That control belongs at the platform level.

Defining the rules that reflect your business’s own risks and constraints, like deciding which refunds need a human sign-off, or what kind of information never gets shared over a specific channel, is a job only your team can do.

Sure, building everything yourself might feel like the safest answer, but building indiscriminately turns into a “guardrail tax” you’ll keep paying agent after agent, channel after channel. And when you move into production, it only gets worse, because failures get exposed at scale and the stakes are higher: 38% of production-stage teams spend most of their time on governance, versus 29% in pre-production.

Drawing the line between the two jobs (the baseline the platform should own and the controls only your team can manage) is a technical leader’s role. Sometimes, the baseline work sits with a vendor’s platform. Sometimes, it’s an internal platform team that builds a control once for every agent team to use.

But when that line isn’t clear, or when the platform your AI agents rely on doesn’t provide some of these controls natively, teams put engineering time into building and rebuilding the basics before deploying each new agent.

What’s more, new platform features or models can make custom-built controls obsolete in no time, forcing teams to be constantly upkeeping these guardrails once the agents hit production.

Every rebuild is time engineering teams don’t spend on innovation, and there’s a cost to this: the backlog keeps filling, and the features that would set the product apart never ship.

When it comes to AI agents, teams tend to drift from the processes meant to stop everyone reinventing the wheel instead of reusing what already exists and works. That means the same safety controls can end up being built by two teams in parallel, without either knowing it. By the third or fourth rebuild, it becomes an operating model problem.

To cut the guardrail tax, start by asking the right questions: How much time goes into what we build ourselves? What have other teams already built? What are we building ourselves that the platform could handle?

Figure out what should live at the platform level and hand it as much as it can own, but don’t trust it blindly.

Understand a control before you rely on it, and keep monitoring, so that when something fails (it will), you can tell whether it came from the platform or the model itself. Then add your own controls over the things the platform already does, where the risk warrants it, like a second PII scan on outbound messages in a regulated flow. That’s defense in depth: a second layer built with intention.

In Production is a monthly editorial newsletter on AI in customer communications, written and published by Sinch. Read past issues on Sinch.com and catch the newsletter on LinkedIn.