- Problem
- A job search means reading many postings, judging each one honestly and tailoring every application – day after day.
- Built
- Ten Claude agent roles collect postings daily, score them against a profile, prepare application documents and learn from every piece of feedback.
- In use
- Nothing goes out without a human sign-off. Decisions happen in a dashboard that works on a phone, and coaches can comment and suggest changes.
Guardrails in code, not trust in the model
- Split permissions: agents that read private data have no web access; agents on the web never see private data.
- Each role runs headless as
claude -pwith--restricted,--strict-mcp-config(every connector off) and its own tool allowlist – only what that role needs. - A
PreToolUsehook blocks sending: email goes out only through a separate service after a click in the dashboard – never from an agent, never from Claude itself. - Source quotes are checked automatically, and a pre-commit hook blocks commits that contain personal data.
- Outside text – postings, websites, emails – enters prompts only as marked material; suspected prompt injection is flagged.
- Web agents · 3 roles Own sandbox, on the web – never see private data
- Marked material Outside text enters prompts only as material; injection flagged, quotes checked
- Private agents · 7 roles Know the profile – no web, own tool allowlist
- Dashboard Cloudflare Pages + D1 behind Cloudflare Access, works on a phone
- Human sign-off The user decides; coaches can comment
- Send service Sends only after a click in the dashboard
All agents: claude -p headless, --restricted, --strict-mcp-config. A PreToolUse hook blocks sending – no agent, and not Claude itself, can send email.