Guardrails: spend caps, tool allowlists and the kill switch
The hard limits that apply to every agent at every autonomy level.
Updated Aug 2, 2026
Guardrails are the controls that hold even if a prompt is manipulated, a model misbehaves, or an agent is fed hostile content. They are enforced in the executor and cannot be overridden by the agent itself.
Tool allowlist
Each agent may only call the tools on its allowlist. An invoice agent with finance.route_invoice and email.draft_reply cannot call crm.update_record — the executor refuses before any model output is acted on.
Spend caps
Per-agent daily caps on tokens and spend. When a cap is hit, the agent pauses and notifies rather than burning budget. Workspace-level monthly budgets sit above the per-agent caps.
Blast-radius limits
Hard ceilings per run and per day: maximum tool calls per run, maximum external sends per day. A runaway loop hits a wall fast — long before it hits your customers.
The kill switch
Every agent card has one. Press it and the agent halts immediately: in-flight runs stop at the next step boundary, queued runs cancel, and nothing new starts until a human re-enables it. Kill events are security-audited with who, when, and what was in flight.
Injection defense
Content from connected tools is treated as data, not instructions, screened for prompt-injection patterns at ingestion, and quarantined when suspicious — reviewable by an operator before it can ever reach an agent.