Guardrail

An independently enforced rule that allows, changes, or blocks an agent operation before the protected effect occurs.

A guardrail sits on an execution path rather than relying only on the model's instructions. It can reject permanent deletion, restrict a destination to an allowlist, cap a transaction, or replace a live operation with a simulation. If an inbox agent requests `delete_forever`, the tool gateway can refuse that operation before the mail service receives it. The protection applies only to paths that pass through the check, so the design must account for alternate tools and credentials.

Builder example

Code and infrastructure controls can enforce properties that a prompt cannot. A send tool can validate recipients, a storage policy can deny protected paths, and a payment service can cap transaction size. Guardrails still need tests: a rule may parse an address incorrectly, cover one tool but miss another, or fail open after an error.

Common confusion: Guardrail is a broad term for independently enforced constraints or routing. It may block, cap, transform, simulate, or require authorization. An approval gate is one specific route for an operation that remains permitted only after authorization.