An AI agent should not have access to every tool, dataset and action just because it can describe them. According to TrueFoundry documentation, guardrails operate at runtime and inspect the actual payload of each interaction: the prompt, the model response, and the arguments and results of tool calls; the decision can be allow, block or rewrite. Dataiku says such a mechanism should operate at the action level, not only after the fact, because only then can an unwanted call be stopped before it touches the target system.
In practice this means three layers of control: limiting what the agent can call at all; checking whether it is allowed to do so in a given context; and recording every decision for audit. Maxim AI documents this as content, access and consumption guardrails: filtering dangerous content, allowlists of permitted models and tools, and rate and budget limits.
If a log does not allow reconstructing the execution flow, it is not useful for audit. Qovery recommends that an auditable trail should include at least the actor identity, timestamp, the exact API request and response, the approving human or policy, and the resulting resource state. Sweet Security's documentation emphasizes recording not only allowed actions but also blocked and escalated ones, to tune policies and detect abuse later.
The safest pattern is storing logs outside the execution system and in append-only mode. Qovery points to off-cluster storage such as CloudWatch Logs, GCP Cloud Audit Logs or S3 Object Lock, and to Falco for detecting runtime behaviours the API server does not see. This is important because an agent may try to act sideways, for example launching a shell in a container or sending unusual outbound traffic.
Content control alone is insufficient if an agent can perform too many actions or operate too broadly in business systems. Maxim AI and Qovery recommend as a baseline tool allowlists, permissions per agent, per task and per environment, and cost and call-count limits. Qovery also adds an approval gate for irreversible actions, since some operations should require a human even if policy formally permits them.
This approach works well as a layered model: first the agent receives only a minimal set of capabilities, then each tool use attempt is evaluated by policy, and finally the record goes to the audit. TrueFoundry notes that each observation can be marked as audit-only, i.e. recorded without blocking, which makes it easier to roll out controls progressively without immediately halting the entire process.
A common mistake is treating a guardrail as a single filter. Sources such as TrueFoundry, Qovery and Dataiku show a control system: logs for reconstruction, limits to stop cost escalation, permissions to limit reach, and manual approvals where an error would be irreversible.
Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.
Source: https://www.qovery.com/blog/ai-agents-kubernetes-audit-trails-policy-guardrails