Guardrails on wording stop an agent being rude or going off-topic. They do not stop it committing your company to a date, a discount or a capability nobody approved. Those are two different problems, and the second one needs a source of truth rather than a classifier.
A guardrail asks is this output acceptable. A commitment check asks is this true, who says so, and may this agent say it — and the second question cannot be answered from the text alone, because the text is fine. We can have that live by the end of the month is a well-formed, polite, on-brand sentence.
| wording guardrails | a commitment check | |
| asks | is this output acceptable? | is this true, and may this agent say it? |
| reads | the text | a register of claims, with owners and dates, and a mandate |
| catches | abuse, prompt injection, off-topic, leaked secrets, tone | a stale price, an unowned claim, a deadline with nothing behind it, an implied approval |
| misses | a true-sounding promise nobody can keep | a rude sentence, an injection attempt |
They are not alternatives. Most teams that come to this have the first and have just discovered they needed the second.
Eight things, each its own setting, so how much rope is a set of decisions rather than a slider:
Three of those never relax: 1, 4 and 8. Not not yet — permanently, and for three different reasons. Implicature is a defect rather than a risk appetite. An agent has no person to stake, so personal authority is either meaningless or a lie. And a deadline with no mechanism behind it generates exactly the failure this exists to prevent.
A customer may add a fourth from the adjustable five. Removing one is not possible.
Four of the five open by connecting something, not by waiting. Absolutes, institutional authority, validation and dependency all need something readable and current — which is a register entry with an owner and a date. So the ladder is a checklist of what your company makes available, not a probation period an agent serves.
Completeness is the exception: it needs a capability rather than a source — knowing what it does not know.
And a source only counts while it is current. Each has an interval and an owner you set. Past it the source is stale and every permission resting on it switches off — not because the agent misbehaved, but because the thing it was relying on went out of date.
This exists so you can give agents more to do safely, not less. Where the choice is between blocking by default and allowing with a ceiling and a record, it takes the ceiling and the record — and the record is what lets you open the next notch with an argument instead of a hope.
/agent-promise-register.md is the register this all reads from. /compare.md is how it sits beside the tools you may already run.