Guardrails
Guardrails are what agents can read, change, and send.
Guardrails set four things for each agent: access (read-only or write), approvals (which actions need a person's sign-off), hard limits such as a spend cap, and which customer data may leave your systems for the model vendor. Read-only lets an agent look at a system, and write also lets it change the system.
A limit on an agent holds only when it's set in the system's permissions and code, never only in the agent's instructions. Today's models usually follow instructions, and "usually" is the problem when the action is spending budget or emailing customers. If a system can't limit an agent's access, keep the agent out of it.
An output filter is sold by some vendors under the name guardrails. It is software that blocks unsafe or off-brand text the model writes, one check a harness can run. A June 2026 paper says a guardrail is one piece of a harness.
Example
Meta documents that its connector can create and edit campaigns. So on a first workflow, give agents read-only access to the ad platforms through the permissions on the account each agent uses. Sending and spending keep a person's approval, even after an agent takes other live actions.