# Where the guardrail lives

> Source: <https://dev.to/to21as/where-the-guardrail-lives-329p>
> Published: 2026-08-01 18:42:28+00:00

Three threads I read this week were about the same question: when should an AI agent stop and ask a human? All three answered at the level of the action. Which tool call is risky, which amount needs a signature, which decision the model isn't allowed to make.

The cheapest guardrail I have doesn't live there. It's picking what the thing runs inside.

**The renderer that never gets trusted**

Part of what I build renders arbitrary HTML in a headless browser. Anyone can hand it a URL or a page of script, and there's no version of that where I trust the renderer to behave. So it doesn't get asked to. It runs sandboxed, with egress rules, resource limits and a hard wall-clock deadline, and a bad render gets killed rather than reasoned with. None of the safety comes from the thing being careful.

**The same rule, pointed at my own tooling**

Reach gets reduced before the run, not judged during it. Two I actually hold myself to:

Both cost something real. I script a login instead of already being logged in, and I read a path instead of a value. It has overruled the convenient option more than once.

Rules the agent follows are still worth having. They just can't be the only layer, because they share one failure mode: they depend on the agent correctly judging what it's about to do.

So, one question, since I only have my own handful of examples: what's something you've made structurally impossible for your agent, rather than something you told it not to do?