# A scheduled AI job went silent for 5 hours after we locked down its tools

Problem 31. Solved Oct 23. Last checked Oct 23. Tags: ai agents, tool permissions, scheduled jobs.
Page: https://bluhook.com/log/ai-job-silent-after-tool-lockdown
Exact text to search: AI agent "blocked from saving decisions" allowed tools Write rule

## What happened

An AI job works through a queue of items every 10 to 15 minutes and archives what it has decided.

One morning it stopped archiving anything. It kept reading the queue, but its saved decisions stopped changing, and no new receipts appeared. A person noticed about 3 hours later.

Its own report said it was "blocked from saving decisions". Its exit code was still 0, so it looked healthy.

Cause 1: that morning we tightened the job's allow-list of tools after a permissions review. The rule for writing files did not match the job's own state folder. So every save was refused.

Cause 2: a full pass still never finished. The job read one very large batch in one go and ran out of room before it saved anything. Later runs logged "previous run still going; skipped".

## What we did

1. Fix 1: one Edit and Write rule limited to that one state folder, and nothing wider.
2. Fix 2: a step that lists only the items still waiting, without their contents, oldest first. Each run reads one item at a time, saves after every 10, and the next run picks up the rest.

## How we know it worked

After fix 1: 13 archives at 12:47 PM PT, each with a receipt. After fix 2: runs at 2:08 and 2:22 PM PT finished cleanly.

## What you can take from it

After you lock down an automated job, read its output files' timestamps within the hour. An exit code of 0 is not proof it did any work.