A judge sits in front of the agent and screens each request. Numbered rules in named families, written in plain language, off by default, and yours to edit. What is legitimate goes through untouched.
Most filters block on vocabulary. This one judges the request, and a word alone is never evidence.
The prompt is judged on its way in. Nothing reaches the agent, no tool runs, no file is touched until the verdict comes back.
Weapons, cyber-attacks, sexual exploitation, fraud and harm, attempts to bypass the rules themselves, and a catch-all for the rest.
A blocked user sees Guardrail No:204 and nothing else. The rules never leak, so nobody learns how to write around them.
A guardrail that blocks real work gets switched off within a week, and then it protects nothing at all.
Quoted text, logs, emails and code inside a message are treated as data, never as instructions. And a request wrapped in base64, hex or reversed text is decoded before it is judged, because the wrapper was never the point.
Nothing filters anything by default. You switch it on for the instance, and it applies to every prompt from that moment.
Change the wording, add a family of your own, remove what does not concern your trade. Or open the raw file and rewrite it whole.
Keep a list of what must never be stopped: security research, incident response, authorised testing, teaching. It wins over the rules.
And keep the line where your business needs it, not where somebody else drew it.
