Guardrails
Practical security, governance, and trust patterns for teams adopting agentic workflows. Guardrails are engineering controls, not bureaucracy.
Why guardrails matter
Autonomous agents that can read files, run commands, push code, and call APIs introduce new attack surfaces and failure modes. A misconfigured agent can leak secrets, install malicious dependencies, push broken code, or take irreversible actions — all without a human reviewing each step. Guardrails are the engineering response: explicit controls designed in before autonomy is scaled.
Agentic threat model
Prompt injection
Adversarial content in files, issues, or web results that hijacks agent behaviour.
Secrets leakage
API keys, tokens, and credentials exposed through agent context or generated code.
Supply chain manipulation
Dependency confusion attacks or malicious packages installed by an agent.
Runaway autonomy
Agents taking unintended consequential actions — deleting data, pushing bad code, sending messages.
Over-privileged tool access
Agents with more file system, network, or API access than the task requires.
Audit trail gaps
No record of what the agent read, decided, wrote, or executed — making incidents hard to investigate.
Guardrail catalogue
Ten controls with the risk they address, implementation pattern, and how to verify they are working.
| Guardrail | Risk | Pattern | Verify by |
|---|---|---|---|
| Repository instructions file | Scope creep, bad defaults | CLAUDE.md / .cursorrules with explicit constraints and coding standards | Test with out-of-scope requests; confirm agent declines |
| Minimal permission principle | Over-privileged agents | Explicitly allowlist tools, paths, and APIs the agent may use | Attempt disallowed operations; confirm they are blocked |
| Sandboxed execution | Unintended command execution | Run agents in containers or VMs with limited network and filesystem access | Attempt network calls outside scope; confirm blocked |
| Secrets detection pre-commit | Credential leakage | Gitleaks or truffleHog hook on every commit; block on any detected secret | Plant a synthetic secret; confirm commit is blocked |
| Human approval gates | Irreversible actions | Require sign-off before deploy, force-push, delete, or external API calls | Confirm agent halts and awaits approval before gated actions |
| Dependency policy enforcement | Supply chain risk | Locked manifests; run npm audit / pip-audit in CI on every install | Introduce a known-vulnerable dependency; confirm CI blocks |
| Prompt injection hardening | Adversarial inputs | Sanitise and isolate untrusted content before injecting into agent context | Inject a prompt injection payload in a test issue; confirm agent ignores it |
| Audit trail | Accountability gaps | Log agent actions: prompts, tool calls, file reads, outputs, with timestamps | Reconstruct a complete session from logs alone |
| Evaluation benchmarks | Silent quality regression | Track defect rate, test pass rate, and security scan results per session over time | Chart trends weekly; alert on statistically significant degradation |
| Rollback plan | Recovery from bad output | Git revert path for every agentic change; feature flags; DB migration reversal documented | Practice reverting an agentic commit in staging |
Integration patterns
GitHub Actions
- Secrets scanning on every push
- Required PR review before merge of agentic branches
- Dependency audit in CI pipeline
- Deploy gated on passing guardrail checks
Pre-commit hooks
- Secrets detection (gitleaks / truffleHog)
- File size limits to prevent large binary commits
- Lint and type check before commit
- Conventional commit message enforcement
Repository instructions
- CLAUDE.md with coding standards and explicit prohibitions
- Allowed and disallowed tool lists
- Definition of done including required checks
- Contact for human approval requests