AI Systems Atlas

H-18Guardrail Middleware

/harnesses/guardrail-middleware

A policy layer wraps the loop and evaluates every proposed action before anything executes.

Step-by-step walkthrough7 steps
  1. The agent proposes an action. It never reaches a tool directly.
  2. Every proposal crosses a layer the model has no way to rewrite or talk out of.
  3. Routine calls pass straight through — the common case stays fast.
  4. A call outside policy is refused, whatever the model was persuaded to attempt.
  5. The refusal returns as context, with its reason. A denial is information, not a crash.
  6. Irreversible or high-blast-radius actions take the third exit and wait for a person.
  7. The model decides what it wants to do; the layer decides what it can do.
Key insight

The model decides what it wants to do; the layer decides what it can do. Because the layer is outside the model, no amount of persuasion inside the context reaches it.

Failure mode

Denials that surface as opaque errors. If the agent cannot see why a call was refused, it retries the same call until the budget runs out.

Further reading
RelatedHuman-in-the-loopDirect prompt injectionPrivilege escalationHooks & lifecycle eventsPermission policies

Elsewhere in the atlas

Security →Evals →Context →Coding Agents →Tools →Ops →