Guardrails

Deny-lists checked by agents before making tool calls. Matches are logged as warning alerts and recorded as escalation events on the calling agent.