Guardrails

Guardrails enforce policy outside the agent prompt. They still run when a prompt is weak, a model is confused, or a user tries to override instructions.

Stages

Stage	Inspects	Result
`input`	User message before dispatch	Reject the turn
`output`	Agent response before delivery	Block the response
`pre-tool`	Tool name and arguments	Deny the call
egress judge	Selected outbound HTTP requests	Allow or block the request

Use LLM-judged egress for outbound content policy.

Guardrails vs nearby layers

Need	Use
Tell the model how to behave	`SOUL.md` or a skill
Hide or expose tools	Tool policy
Enforce policy even if the model ignores instructions	Guardrail
Restrict network destinations	Agent network policy

Built-ins

Name	Stage	Purpose
`secret-scan`	output	Blocks credential-shaped strings
`pii-scan`	input, output, pre-tool	Detects common PII patterns
`forbidden-tools`	pre-tool	Blocks a fixed destructive-tool deny list

const assistant = defineAgent({
  id: "assistant",
  dir: "./agents/assistant",
  guardrails: ["secret-scan", "pii-scan", "forbidden-tools"],
});

See the lobu.config.ts reference.

Inline guardrails

Operators can add inline guardrails directly in lobu.config.ts via guardrailsInline — including LLM judges for input, output, pre-tool, or egress (LLM-judged egress). A pre-tool judge may be narrowed to named tools; a require-tool kind enforces that a tool was actually used.

Skills cannot add guardrails: a skill is instruction text only and can never change authority. Operator exclusions apply last.

The effective set is the union of agent built-ins and operator inline judges.

Audit and improvement

Every trip writes a guardrail-trip event. Operators can inspect it, and automations can group repeated failures into eval cases or proposed policy changes.

Unresolved built-in names are logged and skipped, so check startup logs after changing names.

Failure semantics

Deterministic guardrails should return a verdict rather than throw. The common runner treats an unexpected exception as a pass so an infrastructure failure does not wedge every turn. LLM judges have separate caches and circuit breakers.

Use deployment-specific controls when strict fail-closed operation is required.