Guardrails

Guardrails are deterministic checks that run inside the agent’s container around every tool call. They catch destructive commands, credential leaks and runaway loops before they cause damage. They are defence in depth against accidents; the security boundary is the agent’s isolated container (Security & compliance).

Guardrails are enforced on Pi and Claude Code. Codex enforces read-only mode through its sandbox; Gemini CLI turns are bounded by the execution timeout. See Runtimes.

Baseline rules

Every agent inherits a platform baseline. Per-agent settings can tighten it but never loosen it. If a check fails unexpectedly, the tool call is blocked (fail-closed).

Dangerous commands

Shell commands are matched against a deny-list, including:

Pattern	Example
Recursive deletion of root or home	rm -rf /, rm -rf ~
World-writable permissions	chmod -R 777 /var
Piping remote content into a shell	curl … | bash
Force push	git push -f origin main
Formatting or writing raw disks	mkfs.ext4 …, dd of=/dev/sda
Killing init, fork bombs, shutdown/reboot	kill -9 1, shutdown -h now
Interactive root shells or editing platform hooks	sudo -i, sudo su, visudo

The agent sees a clear denial with the reason.

Protected files

Edits are blocked to .env files, .mcp.json, encrypted credential backups, SSH and cloud credentials (~/.ssh, ~/.aws, ~/.gcp), runtime login and settings files, the read-only configuration and the platform’s own hook scripts.

Credential leak detection

Command output is scanned for leaked secrets — Anthropic, OpenAI, GitHub, AWS, Slack and Google key formats. Matches are logged by pattern name only, never the value.

Turn limits

Each run is capped at 50 turns by default (configurable 1–500, separately for chat and tasks), which prevents runaway loops from burning model spend.

Per-agent rules

Open Settings → Guardrails → Guardrail rules → Manage rules to set Max turns (chat) and Max turns (task), then restart the agent. Through the API you can also add:

Field	Type	Description
max_turns_chat	1–500	Turn limit for chat
max_turns_task	1–500	Turn limit for tasks
execution_timeout_sec	60–7200	Time limit per run
extra_bash_deny	up to 50 patterns	Additional blocked command patterns
extra_path_deny	up to 50 paths	Additional protected paths
disallowed_tools	up to 50 tools	Tools the agent may not use

curl -X PUT https://acme.exohuman.cc/api/agents/market-scout/guardrails \
  -H "Authorization: Bearer $EXOHUMAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"max_turns_task": 20, "extra_bash_deny": ["prod-db.internal"], "disallowed_tools": ["WebFetch"]}'

Send {} to revert to the baseline. Restart the agent to apply changes. The UI preserves API-only fields when saving.

Related controls

• Read-only mode — protect source files.
• Permissions to change itself — fence platform changes.
• Skill approval gates — require a person to approve before certain skills run (Inbox & approvals).
• Model budgets — cap model spend per team.