Guardrails Safety Patterns

Guardrails and Safety Patterns

When to use

Use this skill when an agent can affect files, systems, users, data, external services, security posture, compliance, or public outputs. Apply it to both coding-agent behaviour and application code generated by the agent.

Objective

Apply layered deterministic controls that constrain unsafe inputs, tool use, outputs, and escalation paths.

Procedure

1. Validate and classify incoming requests against scope, safety, and policy rules.
2. Restrict tools and permissions to the minimum required for the task.
3. Sandbox execution and constrain file, network, and data access.
4. Validate outputs, schemas, and generated artefacts before release.
5. Escalate to human review when risk exceeds the safe automation threshold.
6. Record policy decisions, tool use, and outcomes for audit.

Layered guardrail model

1. Input validation: reject malformed, malicious, irrelevant or out-of-scope requests.
2. Policy classification: identify safety, security, privacy, legal and domain constraints.
3. Tool restrictions: allow only the minimum tool permissions needed.
4. Execution sandboxing: isolate code execution and file writes.
5. Output validation: check generated content, code, schemas and artefacts before release.
6. Human escalation: pause when risk exceeds the safe automation threshold.
7. Audit logging: record decisions, tool use and policy outcomes.

Coding-agent controls

• Never print secrets.
• Never weaken authentication or authorisation without explicit approval.
• Never disable tests, linting or security checks to make a build pass.
• Never run destructive shell commands without a clear reversible plan.
• Validate generated code for injection risks, unsafe deserialisation and overbroad permissions.

Implementation guidance

Represent policies as code where possible. Use schema validation, allowlists, sandbox boundaries, static analysis and dependency scanning before relying on LLM judgement.

Guardrails

• Defence in depth is required; a prompt is not a security boundary.
• Fast, low-cost models may be used as pre-screeners, but deterministic checks should enforce hard rules.
• Escalate rather than improvise on safety-critical uncertainty.

OWASP ASI mapping

Use skills_docs/security/OWASP_ASI_CROSSWALK.md for the shared risk map.

| ASI risk | Guardrail control | | --- | --- | | ASI01 Agent Goal Hijack | Validate requested goals against authorised scope before planning or tool execution. | | ASI03 Identity and Privilege Abuse | Enforce task-scoped permissions and deny privileged actions without explicit approval. | | ASI05 Unexpected Code Execution | Sandbox generated code and block unreviewed shell, SQL or infrastructure execution. | | ASI10 Rogue Agents | Add audit logging, behavioural anomaly checks and containment paths for agents that drift from scope. |

Related skills

• apply-laws-of-ai — immutable safety baseline
• human-in-the-loop — approval for high-risk actions
• tool-use-and-function-calling — least-privilege tool execution

References

• OWASP Top 10 for Agentic Applications
• OWASP AI Agent Security Cheat Sheet

Verification

• [ ] Input and output validation exist.
• [ ] Tool permissions are least-privilege.
• [ ] Sensitive data handling is explicit.
• [ ] Unsafe actions require approval.
• [ ] Audit trail is available.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: mmccalla
• Source: mmccalla/coding-agent-skill-library
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.