Skip to main content

Guardrail Specifications

Guardrail specs define policy and permission envelopes for agents.

Required Fields​

  • id
  • version
  • name
  • description

Common Fields​

  • identity/provider context
  • permission maps
  • approval policy
  • token limits
  • data handling constraints

Notes​

  • Guardrails are referenced from agentspecs.
  • Keep policy IDs stable and versioned.

Guardrails and Guards​

A guardrail bounds what an agent may do; nothing in it verifies that the bounds held. A Guard is that verification: it extends a guardrail — the policy it checks against — and adds what is checked, at which stage of an Op, and the signals a Gate decides on.

# guards/permission-guard.yaml
id: permission-guard
extends: default-platform-user:0.0.1
category: policy-safety
stages: [preflight]
check: Each permission the Op's Cogs use is granted by the guardrail.