guardrails-safety-patterns

name	guardrails-safety-patterns
description	Use when implementing input validation, output filtering, tool restrictions, policy enforcement, secure coding controls, destructive-tool guardrails, approval gates, or safe agent behaviour.
aliases	["safety-guardrails","ai-safety-controls","destructive-tools","tool-approval","agent-guardrails","without-approval","destructive-tool-calls","cannot-call-destructive-tools","approval-before-tools","destructive-tool-guardrails"]

Guardrails and Safety Patterns

When to use

Use this skill when an agent can affect files, systems, users, data, external services, security posture, compliance, or public outputs. Apply it to both coding-agent behaviour and application code generated by the agent.

Objective

Apply layered deterministic controls that constrain unsafe inputs, tool use, outputs, and escalation paths.

Procedure

1. Validate and classify incoming requests against scope, safety, and policy rules.
2. Restrict tools and permissions to the minimum required for the task.
3. Sandbox execution and constrain file, network, and data access.
4. Validate outputs, schemas, and generated artefacts before release.
5. Escalate to human review when risk exceeds the safe automation threshold.
6. Record policy decisions, tool use, and outcomes for audit.

Layered guardrail model

1. Input validation: reject malformed, malicious, irrelevant or out-of-scope requests.
2. Policy classification: identify safety, security, privacy, legal and domain constraints.
3. Tool restrictions: allow only the minimum tool permissions needed.
4. Execution sandboxing: isolate code execution and file writes.
5. Output validation: check generated content, code, schemas and artefacts before release.
6. Human escalation: pause when risk exceeds the safe automation threshold.
7. Audit logging: record decisions, tool use and policy outcomes.

Coding-agent controls

• Never print secrets.
• Never weaken authentication or authorisation without explicit approval.
• Never disable tests, linting or security checks to make a build pass.
• Never run destructive shell commands without a clear reversible plan.
• Validate generated code for injection risks, unsafe deserialisation and overbroad permissions.

Implementation guidance

Represent policies as code where possible. Use schema validation, allowlists, sandbox boundaries, static analysis and dependency scanning before relying on LLM judgement.

Guardrails

• Defence in depth is required; a prompt is not a security boundary.
• Fast, low-cost models may be used as pre-screeners, but deterministic checks should enforce hard rules.
• Escalate rather than improvise on safety-critical uncertainty.

OWASP ASI mapping

Use skills_docs/security/OWASP_ASI_CROSSWALK.md for the shared risk map.

ASI risk	Guardrail control
ASI01 Agent Goal Hijack	Validate requested goals against authorised scope before planning or tool execution.
ASI03 Identity and Privilege Abuse	Enforce task-scoped permissions and deny privileged actions without explicit approval.
ASI05 Unexpected Code Execution	Sandbox generated code and block unreviewed shell, SQL or infrastructure execution.
ASI10 Rogue Agents	Add audit logging, behavioural anomaly checks and containment paths for agents that drift from scope.

Related skills

• apply-laws-of-ai — safety-law hierarchy when material AI/instruction risk is present
• human-in-the-loop — approval for high-risk actions
• tool-use-and-function-calling — least-privilege tool execution

References

• OWASP Top 10 for Agentic Applications
• OWASP AI Agent Security Cheat Sheet

Verification

• Input and output validation exist.
• Tool permissions are least-privilege.
• Sensitive data handling is explicit.
• Unsafe actions require approval.
• Audit trail is available.