Guardrails for agents that call external APIs

Guardrail pattern: (1) tool classification: mark each tool as read-only / reversible / irreversible with a risk score. Irreversible tools (write_email, send_payment) require a human-in-the-loop approval step or a confidence threshold above which the agent proceeds solo (e.g., >0.95 calibrated probability). (2) dry-run mode: for batch tools, generate a plan of side effects and require explicit confirmation before executing. (3) rate limits per session. (4) shadow mode: run actions in dry-run for N sessions, log what would have happened, report. (5) prompt-injection sandboxing: rerun tool outputs through a fresh, structured "untrusted content" prompt before passing to the planner. (6) audit logs with full trajectory. (7) rollback capability / idempotency keys on every write. Anthropic specifically probes for "safety-first decisions": the expected answer is a real project where the trade-off was made (security > speed).