What Are AI Coding Agent Guardrails?

Short answer. AI coding agent guardrails are controls that stand in front of a dangerous action — an irreversible command, a leaked secret — and block it before it runs, rather than only reviewing what happened afterward. The distinction matters: a control that only grades a finished run cannot undo a rm -rf or a committed credential. A guardrail has to act before the action completes.

Two lines of defense

Because a harness is not inside the model's inference loop, it cannot intercept a keystroke — so effective guardrails combine two mechanisms:

1. Feedforward, before an action runs. A permission overlay that denies the agent read/write access to files that must never reach a model's context — .env files, private keys, SSH and cloud credentials — plus a hook that blocks a catastrophic shell command (rm -rf /, git reset --hard, a force-push) before the host executes it.
2. Enforced scan, after files are written. A static scan of the working tree for leaked secrets, PII, and prompt-injection strings that refuses to bless a change while any unwaived finding remains.

How Maistik Forge implements this

Forge's guardrails gate is exactly this pairing: a secrets deny-list enforced by the agent's own permission system, a PreToolUse-class hook wired to forge guardrails-gate for destructive commands, and forge secscan as the after-the-fact sweep. It is one of Forge's enforced controls — the small set that checks deterministic evidence and returns a non-zero exit instead of only advising.

Questions people actually ask

Can guardrails be disabled by the AI agent itself?

The deny-list and destructive-action hook are enforced by the coding agent's own permission system and a process hook the agent does not control, not by a request the model can talk its way around. See per-adapter coverage for exactly what each supported agent host enforces.

Do guardrails replace normal code review?

No. Guardrails stop a narrow class of catastrophic, hard-to-reverse actions — they are not a substitute for reviewing the actual change. Forge pairs them with adversarial review and change governance for the parts of a change that need judgment rather than a pass/fail check.