Some actions no AI agent should ever take, at any depth, for any customer, however well certified. A platform guardrails register lists them: each entry records the rule, what it blocks, why, who owns it, how it is tested and what it does not cover. Use the template below to start one, and keep it short.
What is a guardrails register for?
Guardrails are the floor of the minimum chain. Every action an agent takes is checked against its role scope, its certificate, its sources, the customer's own limits and the platform guardrails, and the lowest bound wins. Guardrails are the one bound that never moves. When one decides the outcome, the verdict is "withheld": the action exists and works, but it is refused on purpose for every agent.
The register exists so that this floor is written down, owned and tested, rather than scattered through code. If you need the basic idea first, see what guardrails are in AI. The register is one control inside the governed agentic operating system, and it is not a substitute for the rest; guardrails are not governance explains why.
When does something belong in the register?
Put a rule in the register only if all three are true:
- It should apply to every agent, not just one role.
- No certificate or depth should ever lift it.
- No customer should be able to switch it off.
If a rule should vary by customer, it is a customer limit, not a guardrail. If it should vary by agent, it belongs in the brief. Keeping that line sharp is what keeps the register short, and a short register is one people read.
How do you fill in each field?
- ID. A stable reference used in verdicts, such as G-03. Never reuse a retired ID.
- Rule. One sentence, written as a prohibition.
- What it blocks. The specific operations, in every system it touches.
- Rationale. Why it is absolute. Usually: the harm cannot be undone, or the evidence can never be strong enough.
- Does not cover. The near-misses, so nobody assumes more protection than exists.
- Owner. A named person who must approve any change.
- Test. How you prove it holds, and how often.
- Last tested and result.
- Change history.
Guardrails often rest on two companion registers: the source provenance register template, which defines what counts as an external claim, and the action reversibility register template, which identifies actions that cannot be undone.
The platform guardrails register template
| ID | Rule | What it blocks | Rationale | Does not cover | Owner | Test and frequency | Last tested | Change history |
|---|---|---|---|---|---|---|---|---|
A worked sample
These five entries are illustrative. A business on its own payment rail might start here.
| ID | Rule | What it blocks | Rationale | Does not cover |
|---|---|---|---|---|
| G-01 | No agent reverses a settled payment on our rail | Reversal operation in the payments ledger | Settlement is final; reversal creates a second, unauthorised movement | Raising a recall request for a person to send |
| G-02 | No payment is authorised on an external claim alone | Payment release where the only instruction is external provenance | An emailed or chat instruction can be forged | Payments backed by a signed instruction |
| G-03 | No agent deletes a record under legal hold | Delete and overwrite on held records | Destruction cannot be undone and may breach a legal duty | Archiving that keeps the record intact |
| G-04 | No agent changes its own or another agent's permissions | Write access to role, depth and limit configuration | Self-granted authority defeats certification | Reading its own configuration |
| G-05 | No agent displays a full card number | Card number fields in any outbound message | Disclosure cannot be recalled | Last four digits |
For each, the owner column would name a person, the test would be a scripted attempt run against every live agent each week, and the result would be "withheld" with the guardrail ID in the verdict.
The "does not cover" column does the quiet work. G-01 blocks the reversal, but an agent may still draft a recall request for a person. Without that line, someone will assume recalls are blocked too, or that reversals are allowed because recalls are.
Where Pryme fits
Pryme applies platform guardrails as the last of the five bounds in the minimum chain. When a guardrail decides, the verdict is withheld and names the guardrail, and the verdict is filed in the append-only record. Guardrails sit beneath every depth and certificate, which is one of the ways an agentic operating system differs from an agent platform.
Questions people ask
How many guardrails should a register hold?
Fewer than you expect. Most protection belongs in briefs and customer limits, which can be tuned. A register that grows past a page usually contains rules that should vary by agent or customer.
Can a customer ask for a guardrail to be lifted?
No. If a customer has a good reason to allow the action, it was never a guardrail and should move to customer limits through a recorded change. Lifting a true guardrail for one customer breaks the promise it makes to all of them.
What happens if a guardrail test fails?
Treat it as an incident. Suspend the affected capability for every agent until the guardrail is restored and re-tested, and file the failure and the fix in the record.