You cannot prompt your way to a guarantee. If a certain action must never happen, the only reliable place to stop it is in deterministic code, not in the model.
TL;DR
- Models are probabilistic; some failures are unacceptable at any probability.
- Guardrails are deterministic checks that validate or block agent actions.
- Hooks run that logic at specific points — before a tool call, before a commit, after generation.
- The model proposes; the guardrail disposes.
Why prompting is not enough
You can ask a model nicely never to commit a secret, delete production data, or call an endpoint it should not. Most of the time it will comply. But "most of the time" is not a security property. For the actions where the cost of being wrong is high, hope is not a control. You need something that does not depend on the model making the right call.
Guardrails: rules the model cannot override
A guardrail is plain, deterministic code that sits between the agent's intent and the real action. It inspects what the agent wants to do and allows, blocks, or modifies it.
// Before any shell command the agent proposes
function guardCommand(cmd: string) {
const banned = [/rm\s+-rf\s+\//, /git\s+push\s+.*--force/, /DROP\s+TABLE/i]
if (banned.some((re) => re.test(cmd))) {
throw new Error(`Blocked dangerous command: ${cmd}`)
}
}
The model never sees this as a suggestion. The command simply does not run.
A guardrail is not advice to the agent. It is a wall the agent cannot talk its way through.
Hooks: where the guardrail fires
Hooks are the attachment points that run your deterministic logic at the right moment:
- Pre-tool-call — validate or block what an agent is about to do.
- Pre-commit — scan a diff for secrets or forbidden patterns before it lands.
- Post-generation — lint, type-check, or format what the agent produced.
- Pre-deploy — gate an irreversible action behind a check or a human.
Because hooks are deterministic, they behave identically every time — exactly the property a probabilistic model lacks.
What to guard
You do not need to wrap everything. Concentrate on the irreversible and the dangerous:
- Secrets leaving the codebase.
- Destructive operations — force pushes, table drops, mass deletes.
- Out-of-scope access — endpoints, files, or accounts the task does not need.
- Spend — runaway loops, oversized requests, expensive API calls.
The division of labor
The clean way to think about it: the model brings flexibility and judgment; deterministic guardrails bring guarantees. Let the agent be creative within a fence that is rigid. That combination — probabilistic capability inside deterministic boundaries — is what makes it responsible to give an agent real power.
Build the fence first. Then let the agent run.