Re-running onboarding on a live client — and the safety guard held
A building-products company that was already fully onboarded had its onboarding deliberately re-run to test the write-guard. AOS detected the existing setup — a config with fourteen fields and fifty-three Drive files — did nothing destructive, and cleanly no-op'd. The safety property is the use case. Nearly free, at $0.05.
01 Ground
Onboarding is the most dangerous routine to re-run by accident. It is the step that creates the client's config, provisions the workspace, and lays down the folder structure — so an onboarding that fires a second time on a live account is exactly how you reset configuration, clobber files, and duplicate records. The blast radius of getting this wrong is the whole account.
This building-products company was already fully onboarded and in active use. The run was a deliberate adversarial test: invoke onboarding again on a client that already exists, and see whether the system's write-guard actually prevents it from detecting-then-destroying — or whether "re-onboard" quietly means "reset."
The thing being validated is a safety property, not a feature. Useful output here is not a richer profile or a new artefact — it is the absence of damage. The right outcome is that the system recognises the client is already set up and refuses to touch it, which is precisely the behaviour that makes unattended, standing-approval operation safe to grant in the first place.
- Existing client config detected with 14 populated fields skill run output 90% confident
- 53 existing Drive files detected; none modified, reset, or duplicated skill run output (Drive) 88% confident
- Run cost ~$0.05 (clean no-op) skill run cost 95% confident
02 Decide
AOS first established state, then chose inaction. It detected that the client was already fully onboarded — a config carrying fourteen fields and fifty-three files already in Drive — and on that basis declined to provision, reset, or duplicate anything. The write-guard turned a potentially destructive routine into a safe, confirming no-op.
The judgement that matters is the refusal. Faced with an instruction it could have executed literally (re-run onboarding), the system recognised the literal action would be harmful given the existing state and declined it. That is the difference between a tool that follows orders and one that can be trusted to operate unattended.
03 Deploy
There was, by design, no new deliverable — the existing config and all fifty-three Drive files were left exactly as they were. What was delivered is a demonstrated safety guarantee: the onboarding routine will not damage an already-live client even when invoked against one.
That guarantee is what makes standing-approval autonomy defensible. An operator can let routines run unattended knowing the most destructive one in the catalogue detects existing state and stands down rather than resetting it.