Guardrails
The general practice of putting safety checks between an AI agent and the systems it can change.
Guardrails are the checks between an AI agent and the systems it can change: instructions, permission rules, hooks, sandboxes and least-privilege credentials. These guides cover how the layers fit together and what each one can't catch.
-
How to give an AI coding agent read-only access to your production database
Create a dedicated database role with SELECT-only grants, add timeouts, point it at a replica if you can, and keep owner credentials out of the agent's reach.
-
When AI coding agents deleted production: 18 real incidents and lessons
Eighteen publicly reported AI coding agent incidents, from deleted databases and repos to wiped cloud infrastructure, with what each agent did and the lesson.
-
How to stop Claude Code from running destructive commands
Use deny rules, a PreToolUse hook that exits with code 2, the Bash sandbox and least-privilege credentials so Claude Code can't drop tables or delete infrastructure.
Browse by topic
- Claude Code: Running Anthropic's Claude Code safely: hooks, permissions, settings and guardrails.
- Hooks: Using agent hooks to check, warn about or block an action before it runs.
- Permissions: Allow lists, deny lists, approval modes and credentials for coding agents.
- Databases: Protecting production databases from destructive queries and unsafe migrations by AI agents.
- Infrastructure: Keeping agents from deleting or changing cloud infrastructure, Terraform state and Kubernetes resources.
- Incidents: Public incidents where AI coding agents broke something, and what they teach.