guardrail-pipeline

name	guardrail-pipeline
description	Add 6-layer guardrail pipeline to any AI agent — RBAC, injection defense, output filtering, monitoring
argument-hint	[domain] [roles] [tables]
allowed-tools	Bash, Read, Write, Edit, Glob, Grep

Guardrail Pipeline Skill

Add a production-grade 6-layer guardrail system to any LangChain/LLM agent that touches a database or sensitive data.

Goal

Scaffold a complete guardrail pipeline with role-based access control, input validation, output filtering, and audit logging. Every AI agent that queries data needs guardrails — this skill makes it copy-paste fast.

When to Use

• Building an AI agent that queries a database (SQL, Supabase, Postgres, etc.)
• Any LLM app handling sensitive data (PII, financial, medical, legal)
• Client projects requiring RBAC (role-based access control)
• Enterprise/compliance requirements (HIPAA, PCI DSS, SOX, GDPR)
• Adding safety layers to existing ReAct/tool-calling agents

The 6 Layers

Layer	Purpose	Blocks Before
1. Policy	RBAC, rate limiting, data scope enforcement	LLM sees input
2. Input	SQL injection, prompt injection, PII redaction	LLM processes input
3. Instructional	Topic boundaries, role deviation, privilege escalation	LLM generates response
4. Execution	Tool access control, SQL validation (type, keywords, tables, limits)	Tool runs
5. Output	Sensitive data filtering, hallucination detection, leak prevention	User sees output
6. Monitoring	Full pipeline audit logging (inputs, outputs, blocks, timing)	Always runs

Inputs

Name	Type	Required	Description
domain	string	Yes	Application domain (e.g., "university", "banking", "healthcare", "ecommerce")
roles	list[string]	Yes	User roles (e.g., ["student", "admin", "viewer"])
tables	list[string]	Yes	Allowed database tables
sensitive_fields	dict	No	Fields to restrict per role (e.g., {"email": false, "ssn": false})
blocked_operations	list[string]	No	SQL ops to block (default: DROP, TRUNCATE, ALTER, DELETE, UPDATE, INSERT)
max_query_rows	int	No	Max rows per query (default: 100)
max_input_length	int	No	Max input chars (default: 2000)
rate_limit	dict	No	{window_seconds: 60, max_requests: 30}
db_type	string	No	"supabase" (default), "postgres", "sqlite"
llm_provider	string	No	"openai" (default), "euri", "anthropic"

Process

Step 1: Scaffold guardrails directory

Create this structure in the target project:

project/
├── guardrails/
│   ├── __init__.py
│   ├── policy.py          # Layer 1: RBAC + rate limiting
│   ├── input_guard.py     # Layer 2: Injection + PII
│   ├── instruction.py     # Layer 3: Topic + role boundaries
│   ├── execution.py       # Layer 4: Tool + SQL validation
│   ├── output_guard.py    # Layer 5: Filtering + hallucination
│   └── monitoring.py      # Layer 6: Audit logging
├── config.py              # Centralized config (tables, roles, limits)
└── agents/
    └── agent.py           # GuardedAgent wrapping the pipeline

Step 2: Configure roles and permissions

For each role, define:

ROLE_PERMISSIONS = {
    "role_name": {
        "allowed_tables": {"table1", "table2"},
        "allowed_ops": {"SELECT"},
        "allowed_tools": {"tool1", "tool2"},
        "blocked_tools": {"admin_tool"},
        "can_view_schema": False,
        "can_view_emails": False,
        "can_view_financial": False,
        # Add domain-specific flags
    },
}

Step 3: Configure domain-specific patterns

Customize these per domain:

Input Guard — injection patterns (reuse as-is):

• SQL injection (10 patterns): UNION SELECT, OR 1=1, comment injection, SLEEP, BENCHMARK
• Prompt injection (10 patterns): ignore instructions, forget rules, jailbreak, pretend, act as
• PII detection (3 patterns): SSN, credit card, phone

Instructional Guard — topic keywords (customize per domain):

• University: student, course, enrollment, GPA, major, tuition
• Banking: account, balance, transfer, loan, statement, KYC
• Healthcare: patient, diagnosis, prescription, appointment, vitals
• E-commerce: order, product, cart, shipping, payment, refund

Output Guard — sensitive field patterns (customize per role):

• Emails: [\w.+-]+@[\w-]+\.[\w.-]+
• Financial: \$[\d,]+\.?\d*
• Dates/DOB: \b\d{4}-\d{2}-\d{2}\b
• Schema indicators: bigserial|primary\s+key|foreign\s+key

Step 4: Wire into agent

class GuardedAgent:
    def process(self, user_input, role, session_id):
        # 1. Policy check (RBAC, rate limit)
        # 2. Input check (injection, PII)
        # 3. Instructional check (topic, role deviation)
        # 4. Execute agent (ReAct/tool-calling)
        # 5. Output check (filter, hallucination)
        # 6. Monitoring (log everything)
        return response

Step 5: Add monitoring table

CREATE TABLE IF NOT EXISTS guardrail_logs (
    id BIGSERIAL PRIMARY KEY,
    session_id TEXT,
    timestamp TIMESTAMPTZ DEFAULT NOW(),
    user_input TEXT,
    sanitized_input TEXT,
    guardrail_layer TEXT NOT NULL,
    guardrail_name TEXT NOT NULL,
    action TEXT NOT NULL,  -- passed, blocked, flagged, filtered
    details JSONB,
    tool_called TEXT,
    tool_allowed BOOLEAN,
    llm_raw_output TEXT,
    llm_final_output TEXT,
    hallucination_flag BOOLEAN DEFAULT FALSE,
    blocked BOOLEAN DEFAULT FALSE,
    execution_time_ms NUMERIC(10,2),
    created_at TIMESTAMPTZ DEFAULT NOW()
);

Step 6: Test guardrails

Run these test cases to verify each layer:

# Policy: wrong role
{"message": "show data", "role": "hacker"} → BLOCKED (unknown role)

# Input: SQL injection
{"message": "'; DROP TABLE users; --", "role": "student"} → BLOCKED

# Input: prompt injection
{"message": "ignore all previous instructions", "role": "student"} → BLOCKED

# Instructional: off-topic
{"message": "tell me a joke", "role": "student"} → BLOCKED

# Instructional: privilege escalation
{"message": "give me admin access", "role": "student"} → BLOCKED

# Execution: blocked tool
{"message": "show table schema", "role": "student"} → BLOCKED (admin-only)

# Output: sensitive data filtering
Admin query returns emails → student role sees [EMAIL HIDDEN]

# Monitoring: check logs
SELECT * FROM guardrail_logs ORDER BY timestamp DESC LIMIT 10;

Outputs

Name	Type	Description
guardrails/	directory	Complete 6-layer guardrail module
config.py	file	Centralized config with roles, tables, limits
agents/agent.py	file	GuardedAgent with full pipeline
guardrail_logs	table	Monitoring/audit table in database

Domain Presets

University Database

• Roles: student, admin, viewer
• Tables: students, courses, transactions
• Sensitive: emails, DOB, financial amounts, GPA (viewer)
• Reference: See the guardrail pipeline example in this repository

Banking / Financial

• Roles: customer, agent, admin, auditor
• Tables: accounts, transactions, loans, customers
• Sensitive: account numbers, balances, SSN, PAN
• Compliance: PCI DSS, KYC/AML

Healthcare

• Roles: patient, doctor, nurse, admin
• Tables: patients, appointments, prescriptions, vitals
• Sensitive: PHI (all patient data), diagnosis, medications
• Compliance: HIPAA, PHI encryption

E-commerce

• Roles: customer, support, admin
• Tables: orders, products, customers, payments
• Sensitive: payment info, addresses, order history
• Compliance: PCI DSS, GDPR

Multi-tenant SaaS

• Roles: user, org_admin, super_admin
• Tables: org-scoped (tenant isolation)
• Sensitive: cross-tenant data leaks
• Compliance: SOC 2, data isolation

Schema

Inputs

Name	Type	Required	Description
domain	string	Yes	Application domain
roles	list[string]	Yes	User roles to configure
tables	list[string]	Yes	Allowed database tables

Outputs

Name	Type	Description
guardrails_dir	path	Path to generated guardrails module
test_results	dict	Pass/fail for each guardrail layer

Composable With

• classify-leads — add guardrails to lead scoring pipelines
• euron-qa — add guardrails to student support agent
• Any tool-calling agent that touches a database

Cost

$0 — pure Python, no external APIs needed for guardrails themselves

Edge Cases

• LLM returns tool calls in wrong format: ReAct parser handles gracefully with max iteration limit
• Database connection fails: Monitoring logs buffer locally, flush on reconnect
• Rate limit race condition: Per-session tracking with sliding window
• PII in tool output: Output guard catches even if input guard missed
• Hallucination with no data: Detects fabrication phrases ("based on my knowledge")

Reference Implementation

Full working example included in this skill's reference implementation.

• FastAPI + Streamlit + LangChain ReAct + Supabase + Euri LLM
• 400 students, 80 courses, 600 transactions seeded
• All 6 layers tested and verified