AI Agent Guardrails: How We Build Agents You Can Trust

An AI agent that acts on real systems needs limits that hold even when the model gets it wrong. A rule in the prompt is a request. A rule in the code is a guarantee. Every agent we build has its limits enforced in code: what it may do, who owns it, when it stops and hands over to a person, and what a leaked key or a silent change can cost you.

Each guardrail below links to an article where we explain it and show how we build it.

Limit what the agent can do

Check every action against the task. In a safeguards-off test, Anthropic's own agent went past its task in 9 of 43 runs. We built a guard that checks each action against the task's scope before it runs. Read: the scope guard
Give every agent an owner and an off switch. SK Telecom gives each in-house agent an employee ID, a supervisor and an off switch. Here is the small version any team can build. Read: an owner and an off switch
Never hand the agent a password. Schwab blocks outside agents that log in as its clients. We built a money assistant that never holds a password. Read: an agent that never logs in as you
Guard every path out of the sandbox. A symlink let agents in Docker Sandboxes reach host files through a copy command. Every file channel needs its own boundary. Read: check every path that crosses the wall

Keep a person in the loop

Let code, not the model, decide when the bot stops. New York City proposes fines for support bots that trap customers. Our handoff takes that decision away from the model. Read: the human handoff
Check consent before an AI voice agent dials. In the US, AI-generated voices fall under the TCPA. The consent check runs before the call, so it cannot be skipped. Read: the consent gate

Make a leak cheap and loud

Scope every AI key. Nine AI developer platforms disclosed breaches in October, and stolen AI keys were resold. A scoped key makes a leaked copy cheap and easy to spot. Read: make a stolen AI key worth less

Notice when the agent changes

Run canaries against hosted agents. Anthropic changed Claude Code's behavior with two sentences sent from its servers. A small canary suite tells your team the day an agent changes. Read: agent canaries
Make the model a setting. If your product runs on one model, switching it should be a config change, not a rebuild. Read: make the model switch cheap

Questions

What are AI agent guardrails?

Guardrails are the limits around what an AI agent may do: which actions it can take, which data and systems it can reach, when a person must approve or take over, and how a mistake is caught and stopped. We enforce them in code, outside the model.

Is a rule in the system prompt enough?

No. A prompt asks the model to behave; it does not stop it when it doesn't. We keep the instructions in the prompt and enforce the limits in the code around the model.

Can you add guardrails to an agent we already run?

Yes. We start by reviewing what the agent can reach and do today, then add the checks that matter most first, such as action scope, an off switch and a human handoff.

Do guardrails make the agent less useful?

They make it safe to give the agent more to do. Teams can widen what an agent does on its own as it earns trust, because the limits stay in place.

AI agents with the limits in the code, not the prompt.

Limit what the agent can do

Keep a person in the loop

Make a leak cheap and loud

Notice when the agent changes

Related insights

Docker's agent sandbox leaked through its copy command. Check every path that crosses the wall.

Anthropic changed Claude Code with two sentences. Notice when your agent changes.

Northflank is the ninth AI platform breach this month. Make a stolen AI key worth less.

New York proposes fines for support bots with no way out. Here is the handoff.

Anthropic's own agent went past its task. Here is the guard.

SK Telecom gives its AI agents employee IDs. Yours need an owner and an off switch.

Questions