Two weeks ago we introduced Guardrails: a five-level trust ladder, set per domain, that decides how far your AI teammates can go, from observing to acting on their own. The dial is easy to nod at: pick Propose for deployments, Act with approval for monitors, and move on.
Then the first operational question arrives, and it’s a good one. Levels are set per domain, but an agent runs one tool at a time, a specific merge or query or restart. A level is a promise, and the thing that actually keeps the promise is each individual tool knowing what it may do at the level you picked. So somebody has to answer, for every tool an agent can reach, the same small question five times over: at this level, is this tool off, does it wait for a human, or does it run free?
This post is about who answers that question and what stops a bad answer from doing damage.
A level is a promise about atoms
Start with the size of the problem. Our GitHub connector alone ships 69 tools. Some are harmless on any rung (list_tags reads git tags and nothing else). Some deserve a human in the loop long before full autonomy (push_files commits to your repos). At least one should never run unattended below the top of the ladder (merge_pull_request). That’s 69 separate judgment calls for one connector.
Now widen the lens. The staging account we screenshot below governs 527 tools and capabilities across 19 connectors and 11 teammates. Each of those needs a behavior at each of five levels, which puts the full matrix at over 2,600 cells. And the matrix doesn’t hold still: every connector update can add tools, and an agent gaining a new connector inherits every judgment call that comes with it.
Humans don’t scale to this matrix
Our first version of this was manual, and it worked the way manual permission matrices always work. The first twenty rows get real scrutiny. Page six gets a scroll and a sigh. The engineer who made the careful calls for version one of a connector isn’t in the room when version nine adds four tools, and the defaults those tools land on are whatever somebody guessed under deadline. Multiply by nineteen connectors and the matrix stops being a security control and becomes a liability with a nice UI.
There is also a nastier wrinkle: some tools refuse to be one thing. An omnibus “call any API” tool is a read or a destructive write depending entirely on its parameters. A row like that can’t be filled in by pattern-matching the tool’s name.
A model fills the matrix, and code pins the corners
So classification became a job for a model. When a connector’s tools arrive, an LLM reads each tool’s name, description, and schema, assigns it to one of the six domains, and proposes its behavior at every level.
Letting a model write your permission matrix sounds reckless until you look at where the authority actually sits. The one property that makes a trust ladder a ladder, that permissions only ever loosen as levels rise, is not entrusted to the model. After the model answers, the states are swept in rank order and any dip gets corrected upward, structurally. If the model proposed a tool that works at Propose but vanishes at Act, the sweep repairs it, so the invariant holds even when the model hallucinates.
Three standing rules shape the classifications themselves. Tools that only read work at every level, including Observe, because a read-only rung where reads don’t work would be a contradiction. Genuinely dangerous tools, the permanent deletes and the review-bypassing merges, never get an approval step: they stay off at every level below full autonomy, because putting a human rubber-stamp in front of a mass-delete mostly manufactures rubber stamps.
The seams default safe, too. Tools that declare themselves read-only skip the model entirely and work everywhere. A tool that hasn’t been classified yet, say it arrived in a connector update five minutes ago, starts disabled.
The matrix, signed
A 2,600-cell matrix nobody can hold in their head still has to be explained to a security reviewer, so Guardrails exports it: every connector, every tool, every capability, with its effective behavior at your current levels, plus the masking filters running in your pipelines.
The export is sealed in a way an auditor can check without trusting us. The document carries a SHA-256 computed over its canonical JSON, keys sorted recursively, with the integrity block itself excluded from the hash. Because the hash covers content rather than bytes, the JSON, HTML, and PDF renderings of one export all verify against the same value, and a separate file hash covers the exact bytes you were handed. The verification recipe is written inside the report, so “prove this wasn’t edited” is a script, not a meeting. Two of our services produce these reports in two different languages, and their canonical JSON is byte-compatible on purpose, because two producers whose hashes disagree would be worse than none.
Somebody has to put every tool on the ladder. In practice that somebody is now a classifier, working inside guardrails of its own: a sweep that keeps levels monotonic, defaults that lock unknown tools, and a signed export so you can audit what it decided.
Start a free trial, connect a source, and check the report before your security team asks for it.
