Guardrails and human approval

The model proposes; your code disposes. Lesson 09.01 left a gap between "the model asked for a tool" and "the tool ran", and that gap is the only place in an agent where you have complete control. A guardrail is any check placed there, or at the two other seams: before the model sees the input, and after it produces the output. None of these checks involve asking the model to behave. They are ordinary code, and they run whether the model behaves or not.

Human approval is the same idea with a slower judge. For most of Relay's tools the policy can decide in a microsecond. For a few, such as escalating a ticket as urgent or issuing a refund, the right policy is "a person decides", and the engineering problem becomes how to pause a run, wait minutes or hours, and resume it.