# AI agent guardrails that hold on every run. Guardrails in Arclyx are limits an agent can't talk its way around. It gets only tools you grant, stays inside its spend limits, emails only the person it runs for, can't choose where its Slack messages go, and runs code in a sandbox with no internet access. Arclyx enforces them on every run; they aren't instructions the model may ignore. ## Why do AI agents need guardrails? Because an instruction is a request, not a limit, and an AI agent without guardrails has only instructions. A model can misread a job, loop, or be steered by text it reads on a web page or in an email. Guardrails are the part that doesn't depend on the model behaving: the platform checks them before the agent can act. - Without it: “Only email me” is a line in the prompt - Without it: A loop runs until someone notices the bill - Without it: Code the model wrote can reach the internet - With Arclyx: The email tool can only reach you - With Arclyx: Spend limits stop a run that goes too far - With Arclyx: Code runs isolated, with no internet and no credentials ## What are examples of AI agent guardrails? Here are the six Arclyx puts on every agent. None of them is a prompt: each is enforced by Arclyx outside the model. - **Only the tools you grant**: An agent is given only the tools you grant it. Ready-made jobs mostly read and draft rather than send. - **Spend limits**: Plan limits checked before every run starts, plus a ceiling per run and a monthly cap per agent on paid plans, where admins can cap each member too. - **Delivery limits**: Email goes only to the person the run is for. Slack posts go to the channel you picked, or to that person if you picked none; the model can't choose. - **Sandboxed code**: Code the agent writes runs in an isolated sandbox: read-only, no credentials, no internet access. - **Untrusted content**: Results from outside sources are scanned for prompt-injection patterns, and the agent only opens links its run found. - **Document access**: Access tags decide which documents each person's agents can search. ## Where do you set an agent's guardrails in Arclyx? On the agent's Config tab: how many rounds a run may take, its spend limits on paid plans, the tools it has and the one Slack channel it posts to. ## What kinds of guardrails do AI agents need? A guardrails framework covers each point where an agent can go wrong: what it reads, what it does, what it spends and what it sends. Here is each kind and what Arclyx does about it, including the one it leaves to you. - **Actions**: Only granted tools; ready-made jobs mostly read and draft - **Spend**: Plan limits on every run, plus caps per run and per agent on paid plans - **Delivery**: Email only to the person the run is for; one Slack channel per agent - **Input**: Outside content scanned for injection patterns; only links the run found - **Execution**: Code in an isolated sandbox with no internet and no credentials - **Escalation**: Needs you on Home when a run stops short; a failing schedule pauses itself - **Output**: Not checked for personal data. Review what an agent sends if it handles any. ## How do you stop an AI agent from overspending? Every run is checked against your plan's limits before it starts. On paid plans, also give each agent a ceiling per run, which stops a run before it goes over it, and a monthly cap, after which no new runs start that month. On Free, the plan's daily and monthly limits do that job. - **Per run**: Ceiling per run: a run stops before it goes over it (paid plans) - **Per agent**: Monthly cap: no new runs start this month once it's reached (paid plans) - **Per member**: Admins can set a monthly limit for each person (paid plans) - **At once**: A cap on how many runs each person has going at a time ## How do you set guardrails for a new AI agent? Most are on before you do anything. These are the ones you choose, in the order you meet them when you create an agent. - **Check the tools in the draft**: Remove any it doesn't need. Fewer tools, fewer ways to go wrong. - **Prefer drafting to sending**: Let it draft the email or the post, and send it yourself. - **Pick its one Slack channel**: The only place it can post. The model can't choose another. - **Set its limits**: On paid plans, a ceiling per run and a monthly cap; and how many rounds a run may take. - **Test it on the hard cases**: Try it with inputs that could go wrong before it runs on its own. It's a dry run, so anything it would post or send is shown to you, not sent. ## Can a web page or email take over an agent? It's the risk guardrails are built for. Results from the web, email and other outside sources are scanned for known injection patterns, links are only opened if the run found them, and even a steered agent can only email you and post where you set. ## Can you approve each action before an agent takes it? No. Today the tools you grant are the boundary, so grant only what you'd let it do unattended. That's why ready-made jobs mostly read and draft rather than send. ## Questions about AI agent guardrails. ### What are AI agent guardrails? Limits enforced outside the model: which tools an agent can use, how much it can spend, where it can send results, and where its code can run. ### What are AI agent security guardrails? The ones that protect your data and accounts: least-privilege tool access, each person's own sign-in for built-in tools, isolated code execution, and checks on content from outside sources. In Arclyx they're on for every agent. ### Can an Arclyx agent email anyone it likes? No. Its email reaches only the person the run is for, and in Gmail and Outlook it writes drafts for you to review and send. ### What stops a runaway agent? Spend limits checked before every run, a limit on how many rounds a run may take, and a cap on how many runs each person has going at once. On paid plans, each agent also has its own ceiling per run and monthly cap. ### Does code from the agent run on your servers? In an isolated sandbox with a read-only file system, no credentials and no internet access. ## Where to go next - [Connectors](https://arclyx.ai/product/connectors): What an agent can reach, and how - [Observability](https://arclyx.ai/product/observability): Every step on the record - [The Rogue Model Containment Gap](https://arclyx.ai/blog/the-rogue-model-containment-gap): Why limits belong outside the model ## Create an agent with guardrails on from the start. One sentence in, a working agent out. Join the beta and we'll set you up. Join at https://arclyx.ai/#join or write to hello@arclyx.ai.