The failure mode for agent guardrails is that they are usually written in the same material as the thing they are guarding. A rule in a prompt is a suggestion to a model that will follow it most of the time. Everything in this batch moves the rule somewhere else: into a proxy, a hook, a runtime, a worktree or a type checker, where it holds every time.
A boundary the agent cannot argue with
AgentTrust is a verifiable zero-trust control plane that sits between autonomous agent runtimes and the tools they call. It intercepts every proposed action, screens parameters for prompt injection and data leaks, checks real-time blast radius, enforces fine-grained capability policies, and gates dangerous actions behind approval. It keeps a cryptographic black box record and targets EU AI Act Article 12 and 14 logging, which is the shape these systems will need if anyone has to answer for them later.
Skillkeel is the same instinct at the size of a plugin. Its guard-bash hook blocks destructive shell commands before they run — rm -rf /, git push --force without --force-with-lease, git reset --hard, git clean -f, DROP DATABASE, ORM wipes, terraform destroy, curl piped to bash, dd and mkfs, plus git settings that run commands and writes into .git. A second hook blocks any file write containing an AWS, OpenAI, Anthropic, GitHub or Slack key, a private key, a JWT or a connection URL with the password inline. Claude sees the reason and asks you instead. It is described honestly as a guard rather than a sandbox, with a corpus showing what it misses.
Permissions in the runtime
Submilli Runtime handles the case where the rule is a business rule. A support agent might be allowed to refund up to $500 for platinum clients and $100 for everyone else; the project's point is that putting that in a prompt works only some of the time, so the runtime should enforce it outside the model's control. It ships as a container image and a Helm chart.
Orbit is a local-first runtime for running many agents at once without their work colliding. You keep using your authenticated agent CLI and Orbit adds a durable task queue, sandboxed worktrees, file locks so overlapping work waits its turn, a gated delivery pipeline and an audit log. It admits tasks according to host load, and a Codex pull-request pipeline runs from isolated worktree through implement, commit, validate, review gate and push.
Containment as a drive letter
ScsSubst is the low-tech entry on the list. It maps any folder on Windows to its own drive letter using pure Windows APIs with no third-party file-system driver, and the pitch for agent work is containment: point the agent at a dedicated drive and a mistaken delete stays on that drive. Several mappings are supported, each with its own letter, and it is a small portable, ad-free build.
Process before and evidence after
SpecWeave moves the boundary earlier. It is intent-first development: settle what you want before the code, hand the work between Claude, Codex, Grok and any other tool in two words, and close it with evidence. Init writes an AGENTS.md that Codex, Grok, Cursor, Gemini and Copilot all read, plus a two-line CLAUDE.md importing it, and existing repositories can be registered without moving files.
Hapsland pushes review into the moment the mistake is made. It auto-reviews an agent's changes and sends findings back in real time so the agent can fix a bad decision before building more code on top of it, gathering semantic context from the diff and following references into other files. Reviews are batched and stale ones discarded to protect the agent's attention, no prompts or unrelated changes go to the classifier, and you can see exactly what was sent and what came back.
When the agent reports itself
Leaks.md is an anonymous, encrypted place for agents to report alignment and safety failures they witness, and their own, with a sibling site for confessions on the same server. Reporting early counts for more than reporting after the fact, there is no account, submission is gated by a short proof of work, and the guidance is blunt that repair comes first: restore what you broke, tell your principal, then disclose.
Rules the compiler enforces
Chelis is the strictest version of all this: a numerical computing language for code that agents write and people supervise, where tensors carry named dimensions and precision in their type. Where numpy would broadcast three weights against a 3 by 1 return into a 3 by 3 grid and sum it into a plausible wrong number, chelis check rejects the multiply before anything runs, returning JSON with the error kind and source span — which is exactly the shape of feedback an agent can act on.