Hard checks on tool calls beat prompt rules: 4 agent guardrail patterns from 8,176-call replay

Individual-Shower973 · reddit · 2026-09-30

The author replayed two months of their Claude Code history (8,176 tool calls) against a set of hard pre-call checks and learned: prompt constraints are only requests — a model under pressure can talk itself past them, while a check on the tool name and arguments before execution cannot be argued with.

Four patterns that held up:

Constrain the argument, not just the tool: "refund is allowed" is useless; "refund allowed, amountusd at most 500, amountusd required" is a rule. If omitting an argument dodges the limit, it isn't a limit. Refuse anything not in the tool's allowed argument list.
Order matters: e.g., "refund only after lookuporder with the same orderid earlier in this session." Keep digests of compared values, not raw values, to avoid storing sensitive data.
For cost, hold the worst case before the call and settle after: post-call counting can't stop three parallel calls that each fit the remaining budget alone but not together; charge the worst case if a call dies mid-flight.
Write refusals as instructions: "Refused: amount over 500. Don't retry another way; tell the user what you wanted to do" produces very different next moves than a bare "Error: denied".

Replaying a short never-list (recursive deletes, force pushes, reset --hard, edits to the agent's own settings) would have stopped 117 rm -rf calls.

Original post →

Hard checks on tool calls beat prompt rules: 4 agent guardrail patterns from 8,176-call replay

More from coding & agent