Runtime guardrails: rules your AI agent cannot override.
A prompt guardrail is an instruction the model is trusted to follow. A runtime guardrail is a control the model cannot override: it lives outside the agent, screens every action before it executes, and on Linux enforces the rules in the kernel, below the process. It holds when the prompt doesn't.
Prompt rules ride here. So does poisoned input.
Proposes commands, file touches, and MCP/tool calls.
Screens every action here, outside the agent, before it executes.
Enforcement on Linux: a refused binary never runs.
One poisoned file can rewrite an agent's intentions. It cannot rewrite the kernel.
Three layers: screen, enforce, prove.
InnerWarden implements runtime guardrails as three layers on the machine where your agent works. Each one catches what the layer above misses.
Guard: screen every action before it runs
Every command, file touch, and MCP/tool call your agent proposes is checked against 71 agent threat rules and a risk engine before it executes. Dangerous ones are denied, ambiguous ones go to you, normal work flows untouched.
Enforce: make the dangerous ones impossible
On Linux, enforcement lives in the kernel itself. An unauthorized binary launched by a hijacked agent is refused by the operating system before a single instruction runs. There is no prompt that argues with a denied exec.
Prove: keep evidence of everything it did
A hash-chained, tamper-evident audit trail of every decision stays on your machine. Evidence for you, your customer, or your auditor, and it never leaves your infrastructure.
Keep the prompt rules. Do not make them the last line.
Why prompt-only guardrails fail
Prompt rules travel inside the model's context, which is exactly the surface an attacker controls through poisoned files, web pages, and tool output. When the context is compromised, the rules go with it. Runtime guardrails sit outside the compromised context: the agent proposes an action; the guardrail decides whether it runs.
Use both. Trust one.
Prompt guardrails still make agents behave better on the happy path, keep them. The mistake is trusting them as your last line. The last line has to be something a compromised agent cannot talk to: a screened action queue and, on Linux, the kernel itself.
The best of what we've written on this.
Runtime guardrails, not prompt guardrails
The thesis: why the safety layer cannot live inside the thing being tricked.
ReadWhat happens when an AI agent gets hacked
The attack chain from poisoned input to shell, step by step.
ReadYour AI agent needs a bodyguard
How out-of-process guarding works in practice.
ReadPut a control the model cannot override in front of your agent.
Start free. Prefer to see it work first? Watch one block an attack.
- screenEvery command, file touch, and MCP/tool call checked before it executes.
- enforceOn Linux, an unauthorized binary is refused by the kernel before a single instruction runs.
- proveA hash-chained, tamper-evident audit trail that never leaves your infrastructure.