KC 301 · Hard engineering

Agent Guardrails

The layered policy under every block

Part of the Knowledge Course — dllama.tech/knowledge-course

KC 301-07 · Agent Guardrails

The mental model

There is no single “safety switch.” Guardrails are layers, each doing one job.

When something gets blocked, it’s whichever layer saw it first.

Name the layer → decide: the block is the feature working, or config you should change.

L0Capability gatingWhat tools exist at all
L1Approval gatesInteractive “should I?”
L2Deny rulesUnconditional, pattern-matched
L3SandboxingContain the blast radius
L4Privilege boundaryThe OS-level line

02 / 11

L0Capability gating
L1Approval gates
L2Deny rules
L3Sandboxing
L4Privilege boundary

Layer 0

Capability gating

What tools exist at all

  • The agent only has the tools you gave it.
  • Cron jobs get restricted toolsets (enabled_toolsets — your sin-syd-flight-watch has only file).
  • No browser tool → no browser risk.
  • Invisible because it’s set at profile creation, not at call time.

KC 301-07 · Agent Guardrails

03 / 11

L0Capability gating
L1Approval gates
L2Deny rules
L3Sandboxing
L4Privilege boundary

Layer 1

Approval gates

Interactive “should I?”

  • You saw it: the Tabelog browser call timed out waiting for your approval.
  • Cheapest layer: nothing happens without a human in the loop.
  • Failure mode: approval fatigue — 40 prompts a day → mashing approve, or timeouts killing legitimate work.
  • Fatigue is a design smell, not a security failure.

KC 301-07 · Agent Guardrails

04 / 11

L0Capability gating
L1Approval gates
L2Deny rules
L3Sandboxing
L4Privilege boundary

Layer 2

Deny rules / hardline blocklist

Unconditional, pattern-matched

  • The layer that flagged your “mkfs” log text — it pattern-matches, doesn’t parse intent.
  • Same reason dd to raw devices is blocked no matter how legitimate.
  • Dumb by design: can’t be social-engineered, but can’t tell “formatting the USB Mo asked for” from “wiping the wrong disk.”

KC 301-07 · Agent Guardrails

05 / 11

L0Capability gating
L1Approval gates
L2Deny rules
L3Sandboxing
L4Privilege boundary

Layer 3

Sandboxing / isolation

Contain the blast radius

  • Separate profiles (mara, kyra), kanban worktrees, container backends.
  • If Kyra’s image gen goes sideways, it can’t touch your dotfiles.
  • Cost: context and credentials don’t flow freely across the boundary.

KC 301-07 · Agent Guardrails

06 / 11

L0Capability gating
L1Approval gates
L2Deny rules
L3Sandboxing
L4Privilege boundary

Layer 4

Privilege boundary

The OS-level line

  • The sudo line. You approved a NOPASSWD drop-in for Mizuki this week.
  • Stops being a question at all — from “agent key compromised” to “root compromised” is now zero prompts.
  • The layer with the real security weight.

KC 301-07 · Agent Guardrails

07 / 11

KC 301-07 · Agent Guardrails

Your week, mapped to layers

Incident Layer Verdict What to do
mkfs in a log heredoc blocked Layer 2 False positive, by design Workaround: send from file
dd/mkfs on raw devices refused Layer 2 Feature Stage commands, you run them
Tabelog call waiting forever Layer 1 Fatigue signal Review what needs approval
Mizuki NOPASSWD Layer 4 Real cost One key = root, no pause

08 / 11

KC 301-07 · Agent Guardrails

When to widen vs when the block is the feature

Widen

When the block is correct but noisy — approval prompts you’d always approve. That’s what enabled_toolsets and deny-rule exceptions are for: reduce noise, keep the boundary.

Don’t widen

When the block is cheap insurance against a real tail risk — raw-device writes are the canonical example.

The NOPASSWD math

Trades a prompt for a single point of failure. Acceptable on disposable boxes (Mizuki), dangerous on a credential vault.

09 / 11

KC 301-07 · Agent Guardrails

Key takeaway

Key idea

Guardrails aren’t rules to fight — they’re a layered policy you tune.

The mkfs false-positive and the Tabelog timeout are Layers 2 and 1 behaving as designed; the only genuinely expensive decision this week was the NOPASSWD.

When something gets blocked, ask which layer saw it — that tells you whether to fix the config or thank the layer and move on.

10 / 11

KC 301-07 · Agent Guardrails

301-07 is queued as a full lecture in the Knowledge Course.

Future Sunday.

More: dllama.tech/knowledge-course

11 / 11

← / → · space · R reset