# What Are AI Coding Agent Guardrails?

**Short answer.** AI coding agent guardrails are controls that stand in
front of a dangerous action — an irreversible command, a leaked secret —
and block it before it runs, rather than only reviewing what happened
afterward. The distinction matters: a control that only grades a finished
run cannot undo a `rm -rf` or a committed credential. A guardrail has to act
before the action completes.

## Two lines of defense

Because a harness is not inside the model's inference loop, it cannot
intercept a keystroke — so effective guardrails combine two mechanisms:

1. **Feedforward, before an action runs.** A permission overlay that denies
   the agent read/write access to files that must never reach a model's
   context — `.env` files, private keys, SSH and cloud credentials — plus a
   hook that blocks a catastrophic shell command (`rm -rf /`, `git reset
   --hard`, a force-push) before the host executes it.
2. **Enforced scan, after files are written.** A static scan of the working
   tree for leaked secrets, PII, and prompt-injection strings that refuses
   to bless a change while any unwaived finding remains.

## How Maistik Forge implements this

Forge's [guardrails gate](/harness/guardrails) is exactly this pairing: a
secrets deny-list enforced by the agent's own permission system, a
`PreToolUse`-class hook wired to `forge guardrails-gate` for destructive
commands, and `forge secscan` as the after-the-fact sweep. It is one of
[Forge's enforced controls](/harness/overview) — the small set that checks
deterministic evidence and returns a non-zero exit instead of only advising.

## Questions people actually ask

### Can guardrails be disabled by the AI agent itself?

The deny-list and destructive-action hook are enforced by the coding
agent's own permission system and a process hook the agent does not
control, not by a request the model can talk its way around. See
[per-adapter coverage](/harness/guardrails#per-adapter-coverage) for exactly
what each supported agent host enforces.

### Do guardrails replace normal code review?

No. Guardrails stop a narrow class of catastrophic, hard-to-reverse actions
— they are not a substitute for reviewing the actual change. Forge pairs
them with [adversarial review](/features/review) and [change
governance](/features/governance) for the parts of a change that need
judgment rather than a pass/fail check.