AI Agent Guardrails: Control What Agents Do Before They Do It

AI guardrails vs. agent action guardrails

Most AI guardrails govern what a model says. Once an agent has tool calls with write access to real systems, you also need guardrails on what it does.

You need both. Model guardrails reduce how often an agent decides to do the wrong thing. Action guardrails limit what happens when it does anyway, whether the cause is a prompt injection attack, a hallucinated tool argument, or a retry loop. An injected instruction that gets past the model still has to pass the budget gate, the approval step, and the idempotency check before anything changes.

AgentDelivery does not filter prompts or redact personally identifiable information. It governs the action itself, so it complements the model-level guardrails you already run.

How AgentDelivery guardrails work

Every agent action takes the same path. Each step runs before your systems see the request, so a blocked action never executes.

1. Identify the agent. Each agent calls the typed execute endpoint with its own credentials, not a shared API key. Its policy scope decides which actions it may request.
2. Check policy. Budget, rate, and content gates are evaluated before execution. Spend ceilings and rate caps stop a runaway agent loop; content rules reject payloads with missing or malformed fields. A blocked request returns a clear reason to the agent.
3. Require human confirmation where it matters. Approval gates pause sensitive actions and notify the configured approver. Once approved, execution resumes automatically. Human oversight stays on the few actions that need it, not on every call.
4. Execute once, or roll back. Idempotent execution means a crash, a webhook retry, or an LLM retry after a timeout never fires the same action twice. Bundles group multi-step actions; if one step fails, the preceding steps are rolled back.
5. Record every decision. Each execution, policy decision, and approval is recorded as an OTEL trace. Paid plans add an immutable audit trail (60 to 365 days) for incident reviews and compliance requirements.

Guardrail examples for common agent actions

Match the guardrail to the risk of the action. Low-risk actions run straight through; irreversible actions wait for a person.

A policy is a small JSON document. This one caps a refund agent at €500 a day and 100 actions a minute, and rejects any request without a customer and an amount:

{
  "budget_eur_day": 500,
  "rate_per_minute": 100,
  "require_fields": ["customer_id", "amount"],
  "block_on_violation": true
}

The agent then acts through the SDK. Every call is idempotent, policy-gated, and traced:

from duerelay.agent import Client

client = Client(agent_key="dar_live_...")
result = client.execute("process-refund", {
    "customer_id": "cus_123",
    "amount": 4900,
})