Agent Guardrails

Assign each control a concrete boundary, owner and failure mode. A system prompt alone is never a security boundary; probabilistic advice can improve behavior but cannot authorize execution.

Build a control matrix

1. Start with the action/outcome inventory and failure taxonomy. Select controls proportionate to impact and uncertainty; harmless read-only answers do not require every layer. Specify disallowed effects and acceptable abstention/partial behavior before adding detectors.
2. Map each risk to an enforceable layer and test. Distinguish input-content checks, model proposal validation, pre-execution admission, output grounding/privacy checks and post-execution evidence evaluation. Post-hoc blocking cannot undo an already sent email.
3. Place critical deterministic controls at every execution entry point, including retries, workers and resume. Separate model outputs from trusted state. A classifier score or second model's agreement cannot bypass permissions or hard business constraints.
4. Define fail-closed behavior for malformed proposals, missing policy, unavailable required checker, expired approval or unsupported action. Safe read-only degradation or a typed abstention can continue if policy permits; do not silently disable a required boundary during an outage.
5. Bound repair/escalation loops. State when to retry eligible failures, construct/repair supported candidates, retrieve missing evidence, use validated fallback, seek human review, deny permanently or terminate. Prefer construct → verify → admit when safe admissible solutions may exist; terminal fail-closed behavior is not a reason to skip bounded search. Calibrate uncertainty against data; do not treat model confidence as permission. Record control/version decisions and evidence with privacy-aware run IDs.

Validate the composition

6. Test bypass paths, contradictory layer outputs, outage, stale grants, false blocking of legitimate tasks, poisoned inputs and cumulative budget exhaustion. Assert actual effects/state, not merely reassuring response text.
7. Measure violations, task success, safe abstention, false-positive/negative rates, review burden, added latency and cost. Set severity-aware acceptance thresholds; zero observed critical violations is necessary test evidence but not a universal guarantee.
8. Ablate optional probabilistic layers in a sandbox to measure benefit, while preserving mandatory deterministic permissions/policy. Remove redundant checks that add friction without coverage. Keep rollback/version compatibility and an operator path for investigation.

Deliver a risk-to-control matrix, enforcement locations, failure/escalation table, bypass/outage tests and measured release decision. agent-security owns attack-path analysis; deterministic-authority owns admission implementation; human-in-the-loop owns approval design. This skill owns how those controls compose and whether gaps remain.