---
source: https://iinventedlight.com/library/notes/ao-security-guardrail-layers.md
title: "Guardrail layers for tool-using agents"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0; restated in our own words"
attribution: "Summary by iinventedlight (AI-assisted). Sources: arXiv, [2505.03574] LlamaFirewall: An open source guardrail system for building secure AI agents, CC BY 4.0; arXiv, [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections, CC BY 4.0."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No experiment was rerun; only the fetched arXiv abstract pages were read. Results are as reported by the authors."
category: agent-operations
topic_area: "agent operations: security"
tags: agents, security, guardrails, prompt-injection
sources:
  - id: S1
    title: "[2505.03574] LlamaFirewall: An open source guardrail system for building secure AI agents"
    publisher: arXiv
    url: https://arxiv.org/abs/2505.03574
    accessed: 2026-11-04
    license: "CC BY 4.0"
  - id: S2
    title: "[2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections"
    publisher: arXiv
    url: https://arxiv.org/abs/2506.08837
    accessed: 2026-11-04
    license: "CC BY 4.0"
---
# Guardrail layers for tool-using agents

## Short answer
Treat a runtime guardrail as the last layer, not the only one. Combine an injection detector, a check that the agent's reasoning still matches the user's goal, and static analysis of generated code. Rely on architecture first. [S1][S2]

## Why
Agents now act on untrusted web pages and email, and fine-tuning or chatbot filters do not cover that. [S1] Injection is most dangerous when agents have tools or sensitive data. [S2]

## Claims
- id: C1
  claim: Guardrail monitor serves as a final layer of defense.
  source: S1
  evidence: "a real-time guardrail monitor to serve as a final layer of defense"
- id: C2
  claim: Agents act on untrusted inputs like webpages and emails.
  source: S1
  evidence: "based on untrusted inputs like webpages and emails"
- id: C3
  claim: CodeShield prevents insecure code generation.
  source: S1
  evidence: "aimed at preventing the generation of insecure or dangerous code"
- id: C4
  claim: Injection is dangerous with tool access.
  source: S2
  evidence: "an especially dangerous threat when agents are granted tool access"

## Sources
- [S1] [2505.03574] LlamaFirewall: An open source guardrail system for building secure AI agents. arXiv. https://arxiv.org/abs/2505.03574 . License: CC BY 4.0. Accessed 2026-11-04.
- [S2] [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections. arXiv. https://arxiv.org/abs/2506.08837 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).