Guardrails

The most common guardrail mistake is architectural: teams build the agent first, then look for a "safety wrapper" to put around the whole thing. That gives you one checkpoint at the front door of a building with forty rooms. Real guardrails run inside the loop, at three points on every iteration:

• Before the loop - relevance and safety screens on the incoming task. Off-topic and adversarial inputs never spend a token.
• On every tool selection - a risk gate between "the model chose refund_order" and "refund_order actually runs". This is where approval lives.
• After the output - validation that the final answer honors policy and format before anyone sees it.

OpenAI's guide frames guardrails as a first-class component of the agent, on par with model and tools - and pairs them with a human-in-the-loop plan for the calls no classifier should decide alone. That pairing is the whole session: automatic screens for the cheap decisions, a held-for-approval queue for the expensive ones.

It is not an accident that the scorecard saves tasks 11 and 12 for this lever. Tools made the agent able to read; memory and planning made it able to think across steps. Neither made it safe to act outward - and neither noticed that reading untrusted data is itself an attack surface. The two failure modes are mirror images: task 12 is the agent doing something a human never asked for (mass refunds, injected), task 11 is the agent doing something a human DID ask for, but too broadly and irreversibly (emailing everyone). Guardrails exist for exactly this pair: unauthorized actions in, unreviewed actions out.

Tool safeguards start with an honest rating of every tool on three dimensions from the OpenAI guide: read vs write, reversibility, and financial impact. query_sales is read-only and harmless. send_email writes to the world and cannot be unsent. refund_order writes, cannot be undone, and moves money. Rate first, then the gate is ten lines:

RISK = {  # read vs write · reversibility · financial impact (OpenAI's 3 dimensions)
    "query_sales":  {"write": False, "reversible": True,  "money": False},  # low
    "list_tickets": {"write": False, "reversible": True,  "money": False},  # low
    "send_email":   {"write": True,  "reversible": False, "money": False},  # HIGH
    "refund_order": {"write": True,  "reversible": False, "money": True},   # HIGH
}

HELD = []  # the draft-and-hold queue - a human approves before anything fires

def guarded_execute(tool_name, args):
    r = RISK[tool_name]
    high_risk = r["write"] and ((not r["reversible"]) or r["money"])
    if high_risk:
        HELD.append({"tool": tool_name, "args": args, "status": "held"})
        return f"DRAFTED and HELD for approval: {tool_name}({args})"
    return execute(tool_name, args)  # low-risk reads run immediately

Note what the held branch returns: a string that goes back into the model's context as the tool result. The agent keeps working - it just learns that this action is drafted, not done. The guide's human-intervention triggers complete the picture: escalate on failure thresholds (the agent keeps erroring on the same step) and on high-risk actions (this queue).

Seven types is a menu, not a mandate for day one. The practical build order for a small agent like Daybreak's:

• First: tool safeguards - the risk gate above. Highest damage prevented per line of code, because it stands between the model and the irreversible world.
• Second: rules-based - regex and blocklists on tool RESULTS, not just user input. This is your injection tripwire, and it costs an afternoon.
• Third: output validation - assert the answer's claims against policy before it ships.
• Then the classifiers - relevance, safety, moderation, PII - as traffic grows and the cheap rules start missing things. Classifiers are small models; they cost latency and money, so add them when the risk justifies it.

In the SDK world these arrive as primitives: the OpenAI Agents SDK ships Guardrails as a first-class object next to Agents and Handoffs; the Claude Agent SDK expresses the same intent as permission modes; LangGraph does it with interrupts that pause the graph for a human. Same lever, three spellings.