Guardrails for AI agents: hooks, not hopes

Agents run shell commands faster than I can read them.

Three mistakes I can't afford: a secret read into a transcript, a commit pushed to main, an AI attribution line in a client's git history. A sentence in a prompt asks the model not to. A hook stops the command before it runs.

A pre-tool-use hook reads every shell command and refuses anything that touches an env file.

It matches .env and its variants as a word, so cat .env and source .env.local are blocked, while environment and dotenv pass. It over-blocks on purpose: there is no good reason for an agent to open an env file, so a false positive costs me one manual command. Read and edit deny rules sit beside it. One agent tool needed a JavaScript port, because its permission globs can't express word boundaries.

commit-warden decides whether work is a finished unit and commits it. Nothing else.

• never pushes, not even with force
• no AI attribution and no author override
• no commits to main, master or develop
• stages named paths only, never everything
• one logical change per commit, message as type: description within 72 characters

It flags leftover console logs, TODOs and mixed concerns, and tells me how many commits are waiting to be pushed instead of pushing them.

This one came from a mistake.

An AI trailer slipped into a commit once and I had to amend and force-push to get it out. Now it's off in the settings, not just in a rule.

My memory agent can read, but it can't write.

It drafts what's worth remembering, and the main agent checks it before anything is saved. It never records secrets or transcripts, and when nothing new happened it says so instead of inventing an entry. When sources disagree, the order is: current code, then a fresh check, then the snapshot, then history.

A guardrail you never test is a belief.

When I audited my setup, the profile I use most had no shell hook at all, even though my own notes said it did. Search and write tools weren't covered, and one profile had no guardrails. The rules were written well; the wiring had drifted.