Playbook
Set Up Guardrails on the Action
Why this is hard
Prompt-level guardrails catch bad text but do nothing when a benign prompt drives a harmful action. To actually bound an agent you need guardrails on the action: enforced limits on what it can do, to what, with what scope. And you want to roll them out safely: watching them fire on real traffic before any of them can block a real action.
- Prompt guardrails miss harmful actions driven by benign prompts
- An agent in scope can still take an unsafe action
- Guardrails that block before you trust them are risky to deploy
- A guardrail with no record leaves no proof it is enforced
The approach, step by step
From no guardrails to enforced ones
Put the guardrail on the action
Decide each tool call against policy so the guardrail is on what the agent does, not just the text it reads.
Enforce the three checks
Apply scope containment, tenant isolation, and the sensitivity ladder so writes and sensitive reads are gated.
Start in simulate
Run the guardrails in simulate mode so you see what would be gated or blocked on real traffic without actuating.
Move to enforce deliberately
Once you trust the verdicts, move a domain to recommend and then enforce, knowing deterministic verdicts behave as you saw.
Record every decision
Write each guardrail decision to the ledger so a blocked action becomes audit evidence.
How Fintra Trust does the work
Fintra Trust guardrails are decisions on the action: scope containment, tenant isolation, and a sensitivity ladder, each returning a verdict with a reason. They run in simulate, recommend, or enforce, so you watch them fire on real traffic first, and every decision, including blocked attempts, is recorded.
What you get out of the box
- Guardrails on the action, not just the prompt
- Scope, tenant, and sensitivity enforced per tool call
- Simulate mode to watch before you enforce
- Every guardrail decision recorded as evidence
Avoid the common pitfall
Questions people ask
How do I set up AI guardrails?
Put the guardrail on the action: decide each tool call against scope containment, tenant isolation, and a sensitivity ladder. Start in simulate mode to watch the guardrails fire on real traffic, then move to enforce once you trust the verdicts, recording every decision.
How are these different from prompt guardrails?
Prompt guardrails filter model input and output text; action guardrails decide whether the thing the agent is trying to do should be allowed. A benign prompt can still drive a harmful action, so the action layer is the decisive one.
Can I roll out guardrails safely?
Yes. They run in simulate mode, which decides without actuating, so you can measure their behavior on real traffic before any of them block a real action, then move to enforce deliberately.
What happens when an agent hits a guardrail?
The verdict determines the outcome (allow, allow-with-logging, step-up, review, contain, or deny) and the attempt plus the governing policy are recorded, so a blocked action becomes audit evidence.
Keep reading
Guides
Calculators
One finance briefing a week
New guides, checklists and benchmarks, by email. Unsubscribe from any issue.
Put guardrails on the action
Bound every agent tool call, simulated first. Talk to us: we will map it to your stack.