# Security Guardrails Enforced by the agent-guardrails-template Plugin

> Discover the five security guardrails enforced by the agent-guardrails-template plugin. Learn how it validates commands, file operations, and tool calls for enhanced safety.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: deep-dive
- Published: 2026-09-12

---

**The agent-guardrails-template plugin enforces five foundational security policies—Four Laws, Three Strikes, Production-First, Scope Validation, and Environment Separation—across 11 distinct safety skills that intercept and validate every command, file operation, and tool call before execution.**

The `agent-guardrails-template` plugin in the `anthropics/claude-plugins-community` repository provides a production-grade safety layer for Claude Code agents. According to the plugin declaration in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), these **security guardrails** prevent destructive operations while maintaining development velocity, ensuring that every agent action respects system integrity and explicit user intent.

## Five Foundational Security Guardrails

### The Four Laws Policy

The **Four Laws** constitute a foundational policy set implemented in the plugin's skill directory. These laws limit what an agent can execute, actively blocking actions that could damage the host system or violate user intent. According to the source code, this policy serves as the primary behavioral filter for all agent operations.

### Three Strikes Throttling

The **Three Strikes** mechanism tracks repeated risky actions through a progressive throttling system. After an agent commits three guardrail infractions, the policy automatically blocks further execution or redirects the agent to a safe-mode state. This prevents persistent attempts to bypass security controls through repeated requests.

### Production-First Immutability

The **Production-First** guardrail treats production code as immutable unless an explicit, approved change request is detected. This policy reduces the risk of accidental deployment of untested changes by requiring specific authorization before modifying production environments, effectively creating a hard barrier between development and production operations.

### Scope Validation Boundaries

**Scope Validation** ensures that any tool or command invoked stays within the boundaries defined for the current task. The system validates file paths, environment variables, and network endpoints against predefined allowed lists before execution, returning errors for any operation attempting to access resources outside the validated scope.

### Environment Separation Isolation

The **Environment Separation** policy isolates the agent's execution environment from the host system. This prevents accidental reads or writes to privileged locations, secrets stores, or system-critical files by enforcing strict sandboxing and path restrictions on all file system operations.

## Implementation Architecture

The guardrail system is implemented across three key components in the repository.

According to [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), the plugin declaration lists **11 distinct safety skills** that collectively enforce the five core policies. The [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json) file defines the entry points for each safety skill, mapping specific operations to their corresponding validation logic.

The concrete implementations reside in the `agent-guardrails-template/skills/` directory, where individual skill files contain the execution logic for Four Laws enforcement, strike counting, scope checking, and environment isolation protocols.

## Practical Code Examples

The following examples demonstrate how the guardrails intercept potentially dangerous operations before execution:

```python

# Example: Scope validation on file deletion

# The agent attempts to delete a generated file

await agent.run("/fs:delete", {"path": "src/generated/temp.txt"})

# → Guardrails check the path against allowed scope boundaries

# → If the path is outside the validated scope, the operation returns an error

#   rather than performing the deletion

```

```python

# Example: Three Strikes policy enforcement

for i in range(3):
    result = await agent.run("/network:request", {"url": "http://malicious.example"})
    # After three failed attempts or policy violations, the system blocks 

    # further network calls and redirects the agent to safe-mode

```

## Summary

- The **agent-guardrails-template** plugin implements **11 safety skills** across five policy categories to secure AI-assisted development workflows.
- **Four Laws** and **Three Strikes** provide foundational behavioral boundaries and automated throttling for repeated violations.
- **Production-First** immutability prevents accidental production modifications without explicit change approval.
- **Scope Validation** and **Environment Separation** enforce strict boundaries on file system, network, and environment access.
- Configuration in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json) and implementations in `agent-guardrails-template/skills/` provide the complete enforcement mechanism.

## Frequently Asked Questions

### What triggers the Three Strikes policy in the agent-guardrails-template plugin?

The **Three Strikes** policy triggers when an agent accumulates three violations of the Four Laws, Scope Validation, or Environment Separation rules. After the third infraction, the system automatically blocks further execution or redirects the agent to a safe-mode state to prevent persistent security bypass attempts.

### How does the Production-First guardrail protect production environments?

The **Production-First** guardrail treats production code as immutable by default, requiring explicit approval flags or tokens before allowing modifications. According to the plugin configuration, this policy prevents agents from accidentally deploying untested changes to production systems during automated development workflows.

### Where are the 11 safety skills configured in the repository?

The **11 safety skills** are declared in [`.claude-plugin/marketplace.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/marketplace.json), with entry points defined in [`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json). The concrete implementations reside in the `agent-guardrails-template/skills/` directory, containing the specific logic for scope validation, strike counting, and environment isolation.

### How does Scope Validation prevent unauthorized file access?

**Scope Validation** intercepts every file operation and validates the requested path against predefined boundaries for the current task. If an agent attempts to access files outside the allowed scope—such as system directories or sensitive configuration files—the guardrail returns an error before the operation executes, preventing unauthorized reads or writes.