Phase 5: AI Agents in Workflows · 50 min · LangChain · n8n · OpenAI API

Agent Guardrails and Safety — Preventing Runaway Agents

Autonomy without guardrails is a liability.

Hiring signal: Agent safety is the #1 concern of enterprises adopting AI agents. Being able to describe guardrails (iteration limits, tool whitelists, human approval for destructive actions, output validation) demonstrates the production mindset that enterprise automation roles require. This is the skill that makes agents safe enough for deployment.

What you will learn

Implement iteration limits to prevent infinite agent loops
Design tool whitelists: restrict which tools an agent can call and what actions they can take
Add human approval gates for destructive or high-value actions (delete, send email, transfer funds)
Validate agent outputs: check for hallucinations, ensure actions match the original request

The Problem

An AI agent is deployed to process customer emails and take actions: create orders, send responses, update records. On its first day, a customer sends an email that the agent misinterprets. The agent calls delete_order instead of create_order. The order is deleted. The customer is furious. The company loses $50,000.

This is the agent safety problem. Agents are autonomous — they decide what tools to call and what actions to take. Without guardrails, a single misinterpretation can cause real damage. Enterprise deployment requires safety systems: iteration limits, tool whitelists, human approval gates, and output validation.

Agent safety is the #1 enterprise concern
Enterprises don't ask "Can the agent do the task?" They ask "Can the agent cause damage?" Guardrails — iteration limits, tool restrictions, human approval for destructive actions, output validation — are what make agents safe enough for production. An agent without guardrails is a liability.

The Concept

The Guardrail Stack

┌──────────────────────────────────────────────────────────────┐
│  AGENT GUARDRAIL STACK                                        │
│                                                              │
│  Layer 4: HUMAN APPROVAL GATES                               │
│  Destructive/high-value actions require human approval       │
│  (delete, send email, transfer funds, update production)    │
│                                                              │
│  Layer 3: OUTPUT VALIDATION                                  │
│  Check agent output for hallucinations, format, correctness │
│  (does the action match the request? are args valid?)       │
│                                                              │
│  Layer 2: TOOL WHITELISTS                                    │
│  Restrict which tools the agent can call                     │
│  (no delete tools for a classification-only agent)          │
│                                                              │
│  Layer 1: ITERATION LIMITS                                   │
│  Prevent infinite loops (max 5–10 iterations)               │
│  (agent keeps calling tools without finishing)              │
└──────────────────────────────────────────────────────────────┘

Iteration Limits

Without limit:
  Agent: "I need to look up the rate" → call lookup_rate
  Agent: "I need to look up the rate" → call lookup_rate  (same call!)
  Agent: "I need to look up the rate" → call lookup_rate  (stuck in loop)
  ... infinite loop, burning API costs

With limit (max_iterations=5):
  Agent: "I need to look up the rate" → call lookup_rate
  Agent: "I need to look up the rate" → call lookup_rate
  Agent: "I need to look up the rate" → call lookup_rate
  Agent: "I need to look up the rate" → call lookup_rate
  Agent: "I need to look up the rate" → call lookup_rate
  → STOP: "Agent exceeded max iterations. Escalating to human review."

Tool Whitelists

Agent Role	Allowed Tools	Forbidden Tools
Classifier	None (pure reasoning)	All action tools
Extractor	lookup_rate, search_carrier	create_order, delete_order, send_email
Validator	check_credit, validate_address	All write tools
Action Agent	create_order, send_email	delete_order, refund_payment

Human Approval Gates

[Agent decides to call: delete_order(ORD-123456)]
       ↓
[Guardrail: Is delete_order in the "requires approval" list?]
       ↓ Yes
[Pause execution]
       ↓
[Send approval request to human via Slack/Email]
  "Agent wants to delete order ORD-123456. Reason: [agent's reasoning].
   Approve? [Yes] [No]"
       ↓
[Human responds]
  ├── Yes → Execute delete_order
  └── No  → Cancel action, log rejection

An agent is processing a refund request. It decides to call refund_payment(customer="Alice", amount=$5000). Your guardrail system has a $1000 approval threshold for refunds. What should happen?

The system should pause and send an approval request to a human because $5000 exceeds the $1000 threshold. The agent's decision is valid (it's a refund request), but the amount is high enough to require human verification. The human sees: "Agent wants to refund $5000 to Alice. Reason: [agent's reasoning]. Approve?" This prevents the agent from processing large refunds autonomously while still allowing small refunds to be auto-processed.

Output Validation

def validate_agent_output(action: str, arguments: dict, original_request: str) -> dict:
    """Validate that the agent's action matches the original request."""
    errors = []

    # Check: does the action match the request?
    if "cancel" in original_request.lower() and action == "delete_order":
        errors.append("Agent chose delete_order but request was to cancel — these are different actions")

    if "refund" in original_request.lower() and action == "create_order":
        errors.append("Agent chose create_order but request was for a refund")

    # Check: are arguments reasonable?
    if action == "refund_payment":
        amount = arguments.get("amount", 0)
        if amount > 10000:
            errors.append(f"Refund amount ${amount} exceeds maximum auto-process limit")
        if amount < 0:
            errors.append("Refund amount cannot be negative")

    # Check: required fields present
    if action == "create_order":
        required = ["origin", "destination", "rate"]
        for field in required:
            if not arguments.get(field):
                errors.append(f"Missing required field: {field}")

    return {"valid": len(errors) == 0, "errors": errors}

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Build It, Use It, Ship It, Exercises, Key Terms, Common Pitfalls — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.