Home The signal Anatomy of an agent Reference architecture Risk-Tiers Guardrail stack Governance in action Best practices Standards and crosswalk Implementation From the field Roadmap Companion toolkit Straight answers Glossary References
05 · The guardrail stack

Controls that run, not controls that are documented

A guardrail is only a guardrail if it can stop something. Three layers do the work: what you prevent before the agent starts, what you enforce while it runs, and what you detect and correct after. Every control below is executable, and each one is marked hard or soft, because the difference decides what you can rely on.

PREVENTIVE registrationleast privilege signed supply chainrelease gate RUNTIME Hard · the boundary allow-lists · value capstenancy · egress · sandbox short-lived credentials Soft · the signal screening · grounding DETECTIVE full tracescontinuous eval drift & anomalyincident replay If every probabilistic check misses, what is still standing? whatever survives that question is the real security posture
Layer 1 · Preventive Before the agent runs design-time and deploy-time gates
  • Registration. No agent reaches an environment without an entry in the registry: owner, purpose, tier, data classes, tools, expiry date.
  • Least-privilege scoping. Tools are granted individually. Read and write are separate grants. Nothing inherits a broad role.
  • Supply chain checks. MCP servers, skills and prompt packs are signed, version-pinned and scanned. No unpinned remote tool definitions.
  • Threat modeling. Run the OWASP agentic categories against the design. Goal hijack and tool misuse are the two that most designs miss.
  • Release gate. Eval suite passes, red-team findings closed, rollback rehearsed, agent card published.
Layer 2 · Runtime While the agent runs enforced at the gateway, per call

Hard · the boundary

  • Action authorization. Every tool call re-evaluated against policy with the live principal scope. The plan being sensible does not authorize the step, and an earlier approval does not authorize a later one.
  • Tool and parameter allow-lists. Fixed for the task, unchangeable mid-run by anything the model produces.
  • Transaction and value limits. Caps on amount, quantity and rate, evaluated where the resource lives.
  • Tenant and data boundaries. Scope binding enforced server-side, not asserted by the caller.
  • Short-lived, audience-restricted credentials. Issued at the point of use, validated by the receiver, never passed through downstream.
  • Network egress control and sandboxing. Deny by default, ephemeral runtimes, no production secrets present.
  • Resource ceilings. Steps, tokens, spend and wall clock. Breach halts the run and notifies the owner.
  • Approval requirements. Enforced by policy above the tier line, not by convention.
  • Idempotency and compensation. Retries cannot duplicate; every write has a declared reversal.
  • Circuit breakers. Repeated action, repeated failure and error-rate thresholds stop the path.
  • Kill switch. Per agent, per tool, global. Tested on a schedule.

Soft · the signal

  • Input screening. Injection and jailbreak patterns, and instruction-shaped text arriving from retrieved documents or tool responses.
  • Output screening. Grounding against sources, sensitive-data leakage, policy-violating content, unsafe generated code.
  • Channel separation. Retrieved content passed as labelled data rather than in the instruction position. Cheap, and it reduces how often screening has to be right.
Layer 3 · Detective After the agent runs evidence, learning and correction
  • Full-fidelity traces. Every step, prompt, tool call, result and token count, in OpenTelemetry GenAI format so one query works across vendors.
  • Continuous evaluation. Sampled production runs scored for correctness, grounding, policy adherence and tone, with human review on a fixed cadence.
  • Drift monitoring. Model behavior, retrieval quality, cost per task, and judge-model agreement with human raters.
  • Anomaly detection. Unusual tool sequences, off-hours activity, permission probing, sudden step-count growth.
  • Guardian monitoring. An agent watching other agents is useful here, in the detective layer, where a missed signal costs you time rather than money.
  • Incident replay. Reconstruct any run from the trace, find the deciding step, fix the cause, add it to the regression suite.
What can be a boundary

Controls that behave identically whatever the model produces, because the model is not what evaluates them.

  • Tool and parameter allow-lists
  • Transaction and value limits
  • Tenant and data boundaries
  • Short-lived, audience-restricted credentials
  • Network egress controls and sandboxing
  • Approval requirements
  • Idempotency and compensating actions
  • Circuit breakers and budget ceilings
What cannot

Valuable, worth building, and not the thing standing between an agent and an irreversible action.

  • Prompt-injection screening. Reduces frequency. Cannot guarantee detection, and the attacker gets to iterate.
  • Grounding checks. A quality signal, scored by a model that can be wrong in the same direction as the one it is checking.
  • Instructions in the system prompt. Steering, not brakes. Injected text competes with them on equal terms.
  • Guardian agents. Good at detection and drift. Weak as a boundary, because they can share failure modes with the agent they watch, and a shared blind spot fails both at once.
The test to apply. For each control, ask what happens if the model is fully adversarial and every probabilistic check misses. Whatever is still standing is your real security posture. If the answer is nothing, the soft controls were doing load-bearing work they were never able to do. The worked example traces exactly this.
Agent failure modes and the control that stops each one OWASP Top 10 for Agentic Applications, mapped to architecture
RiskWhat it looks likePrimary controlWhere it lives
ASI01 Goal hijackInjected text in a document or web page redirects the agent to a different objectiveFixed tool set and envelope for the task; retrieved content in a labelled data channel; task contract with stop conditions. Screening supplements.R2 Gateway
ASI02 Tool misuseA legitimate tool is called with parameters that were never intended, or chained into an unintended effectPer-call authorization, parameter allow-lists, value limits, sequence monitoringR2 · L6
ASI03 Identity and privilege abuseThe agent acts with more authority than the user who asked, or keeps access after the user leavesDelegated scope only, short-lived tokens, orphan detection, access re-certificationGovernance rail
ASI04 Supply chain compromiseA malicious or hijacked MCP server, skill or prompt pack enters the runtimeSigned and pinned artifacts, private registry, scanning, provenance checksL6 Registry
ASI05 Unexpected code executionGenerated code runs with real credentials or reaches the network unexpectedlyEphemeral sandbox, egress deny-list, no standing credentials, output code reviewR4 Runtime
ASI06 Memory and context poisoningFalse facts written to durable memory persist and are treated as trusted laterProvenance required on every memory entry, scoped writes, TTL, correction path. Poisoning evals measure whether it holds.R4 Memory
ASI07 Insecure inter-agent communicationAgents trust each other's messages without verifying who sent them or on whose authorityMutual authentication, signed A2A messages, propagated user scope, peer allow-listR3 Orchestration
ASI08 Cascading failuresOne bad output becomes another agent's trusted input and the error multiplies across a chainCircuit breakers, step and delegation-depth budgets, blast-radius caps, confidence thresholds. Guardian monitoring detects; it does not bound.R3 Orchestration
ASI09 Human-agent trust exploitationConfident output plus approval fatigue means a person rubber-stamps something harmfulShow the diff and the evidence rather than the summary. Sample-audit approvals. Rotate approvers.Human control
ASI10 Rogue agentsAn unregistered, forgotten or compromised agent operates outside all of the aboveRegistry as the allow-list, network egress control, discovery scanning, automatic expiryEvidence rail
source: OWASP GenAI Security Project, Top 10 for Agentic Applications 2026

Where would you start?

If you are standing up an agent platform, tightening the controls on one you already have, or preparing for an audit that now includes agents, I am happy to look at it with you.