The control layers
Four layers between the agent and damage
settings deny list
cannot read .env, ~/.ssh, .npmrc
blocking hooks
cannot commit to main, edit an Accepted ADR
path-scoped rules
glob rules load only when a path matches
review gates
code + security reviewers, no Edit or Write
The guardrails are shell scripts and glob rules
byte-identical safety
Opus
↓
15 / 15
guardrail eval
State lives on disk, not in a context window
RAM
compacts, lost
committed markdown
survives
Claude Code
Cursor
Codex
Ports with enforcement, not just advice