Security Guardrails Enforced by the agent-guardrails-template Plugin

The agent-guardrails-template plugin enforces five foundational security policies—Four Laws, Three Strikes, Production-First, Scope Validation, and Environment Separation—across 11 distinct safety skills that intercept and validate every command, file operation, and tool call before execution.

The agent-guardrails-template plugin in the anthropics/claude-plugins-community repository provides a production-grade safety layer for Claude Code agents. According to the plugin declaration in .claude-plugin/marketplace.json, these security guardrails prevent destructive operations while maintaining development velocity, ensuring that every agent action respects system integrity and explicit user intent.

Five Foundational Security Guardrails

The Four Laws Policy

The Four Laws constitute a foundational policy set implemented in the plugin's skill directory. These laws limit what an agent can execute, actively blocking actions that could damage the host system or violate user intent. According to the source code, this policy serves as the primary behavioral filter for all agent operations.

Three Strikes Throttling

The Three Strikes mechanism tracks repeated risky actions through a progressive throttling system. After an agent commits three guardrail infractions, the policy automatically blocks further execution or redirects the agent to a safe-mode state. This prevents persistent attempts to bypass security controls through repeated requests.

Production-First Immutability

The Production-First guardrail treats production code as immutable unless an explicit, approved change request is detected. This policy reduces the risk of accidental deployment of untested changes by requiring specific authorization before modifying production environments, effectively creating a hard barrier between development and production operations.

Scope Validation Boundaries

Scope Validation ensures that any tool or command invoked stays within the boundaries defined for the current task. The system validates file paths, environment variables, and network endpoints against predefined allowed lists before execution, returning errors for any operation attempting to access resources outside the validated scope.

Environment Separation Isolation

The Environment Separation policy isolates the agent's execution environment from the host system. This prevents accidental reads or writes to privileged locations, secrets stores, or system-critical files by enforcing strict sandboxing and path restrictions on all file system operations.

Implementation Architecture

The guardrail system is implemented across three key components in the repository.

According to .claude-plugin/marketplace.json, the plugin declaration lists 11 distinct safety skills that collectively enforce the five core policies. The .claude-plugin/plugin.json file defines the entry points for each safety skill, mapping specific operations to their corresponding validation logic.

The concrete implementations reside in the agent-guardrails-template/skills/ directory, where individual skill files contain the execution logic for Four Laws enforcement, strike counting, scope checking, and environment isolation protocols.

Practical Code Examples

The following examples demonstrate how the guardrails intercept potentially dangerous operations before execution:

# Example: Scope validation on file deletion

# The agent attempts to delete a generated file

await agent.run("/fs:delete", {"path": "src/generated/temp.txt"})

# → Guardrails check the path against allowed scope boundaries

# → If the path is outside the validated scope, the operation returns an error

#   rather than performing the deletion

# Example: Three Strikes policy enforcement

for i in range(3):
    result = await agent.run("/network:request", {"url": "http://malicious.example"})
    # After three failed attempts or policy violations, the system blocks 

    # further network calls and redirects the agent to safe-mode

Summary

• The agent-guardrails-template plugin implements 11 safety skills across five policy categories to secure AI-assisted development workflows.
• Four Laws and Three Strikes provide foundational behavioral boundaries and automated throttling for repeated violations.
• Production-First immutability prevents accidental production modifications without explicit change approval.
• Scope Validation and Environment Separation enforce strict boundaries on file system, network, and environment access.
• Configuration in .claude-plugin/marketplace.json and implementations in agent-guardrails-template/skills/ provide the complete enforcement mechanism.

Frequently Asked Questions

What triggers the Three Strikes policy in the agent-guardrails-template plugin?

The Three Strikes policy triggers when an agent accumulates three violations of the Four Laws, Scope Validation, or Environment Separation rules. After the third infraction, the system automatically blocks further execution or redirects the agent to a safe-mode state to prevent persistent security bypass attempts.

How does the Production-First guardrail protect production environments?

The Production-First guardrail treats production code as immutable by default, requiring explicit approval flags or tokens before allowing modifications. According to the plugin configuration, this policy prevents agents from accidentally deploying untested changes to production systems during automated development workflows.

Where are the 11 safety skills configured in the repository?

The 11 safety skills are declared in .claude-plugin/marketplace.json, with entry points defined in .claude-plugin/plugin.json. The concrete implementations reside in the agent-guardrails-template/skills/ directory, containing the specific logic for scope validation, strike counting, and environment isolation.

How does Scope Validation prevent unauthorized file access?

Scope Validation intercepts every file operation and validates the requested path against predefined boundaries for the current task. If an agent attempts to access files outside the allowed scope—such as system directories or sensitive configuration files—the guardrail returns an error before the operation executes, preventing unauthorized reads or writes.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}