Tag
guardrails
18 entries, including 5 patterns.
The guardrail judged the message, not the conversation
Crescendo reaches a forbidden answer through turns that each look harmless. A per-message filter scores every one of them clean, because the violation exists only in the sequence.
- Pattern
Effect-Bound Tool Route Gate
Authorize the effect at the service, regardless of which agent tool pipeline requested it.
The guardrail only wrapped one kind of tool
A per-tool safety check can be correct on the route it covers and irrelevant on the route that makes the same consequential change.
The hook went quiet; traffic did not
An inline AI policy can be configured and healthy-looking while requests pass uninspected. Measure enforcement coverage, not just denials.
- Pattern
Verdict Coverage Accounting
Join independent request counts to hook verdicts and configuration state so silent inspection gaps are observable and high-impact actions stay gated.
- Pattern
Pre-Dispatch Side-Effect Gate
Separate blocking run admission from a mandatory target-facing decision so a late tripwire cannot masquerade as prevention.
The guardrail finished after the send
A parallel input check can reject a run after its tool has already sent data. Put the security decision ahead of dispatch, not beside it.
A blocklist is not a jailbreak gate
String-match filters judge the surface of a prompt. Adversaries operate on the tokens the model actually reads.
Inspected is not executed
A safety check on the raw command or code string does not prove the runtime will execute that same string.
Rejected is not blocked
A finishReason of tool_rejected does not prove the tool never ran.
Syntax is not intent
A well-formed tool call can still be the wrong action. Clear syntax is not a policy verdict.
Unset is not deny
When the webhook secret is absent, an if-secret check never runs. A warning is not a closed gate.
A block rate is not a security outcome
Measure whether a guardrail prevented the unwanted action, whether responders saw it, and whether the same control broke legitimate work.
- Pattern
Outcome-Based Guardrail Assurance
Test prevention, detection and response against observable actions in a controlled environment.
The guardrail that waved traffic through
A green light on the model path is not containment if the tool can run without that path.
- Pattern
Verified Dispatch Path
A control pattern for security architects and platform teams who run agent harnesses with model-layer guardrails. It treats a green dashboard as worthless unless tool dispatch requires a trusted execution record and an explicit policy decision — so forged history and co-opted judges cannot wave traffic through.
An outbound token is not inbound auth
A stored upstream credential lets the MCP server act. It does not prove who is calling it. Two Critical advisories show the same residual when that gate is missing.
MCP preview paths are host execution
LiteLLM’s MCP connection-test endpoints spawned the caller’s command on the proxy host. A preview surface with host privileges is a control plane, not a sandbox.