Class: SafeGuardrails
Defined in: security/SafeGuardrails.ts:170
Safe Guardrails - validates tool calls before execution
Constructors
Constructor
new SafeGuardrails(
config?):SafeGuardrails
Defined in: security/SafeGuardrails.ts:177
Parameters
config?
SafeGuardrailsConfig = {}
Returns
SafeGuardrails
Methods
addFolderRule()
addFolderRule(
agentId,rule):void
Defined in: security/SafeGuardrails.ts:247
Append a folder access rule to an agent's permission config at runtime.
If no config exists, creates one with defaultPolicy: 'deny'.
Parameters
agentId
string
rule
Returns
void
getFolderPermissions()
getFolderPermissions(
agentId):FolderPermissionConfig|undefined
Defined in: security/SafeGuardrails.ts:226
Get folder permissions for an agent (if configured).
Parameters
agentId
string
Returns
FolderPermissionConfig | undefined
getViolationStats()
getViolationStats(
agentId,timeRange?):Promise<{bySeverity:Record<string,number>;byTool:Record<string,number>;total:number; }>
Defined in: security/SafeGuardrails.ts:579
Get violation statistics for an agent
Parameters
agentId
string
timeRange?
end
Date
start
Date
Returns
Promise<{ bySeverity: Record<string, number>; byTool: Record<string, number>; total: number; }>
hasFolderPermissions()
hasFolderPermissions(
agentId):boolean
Defined in: security/SafeGuardrails.ts:212
Check whether folder permissions have been configured for an agent.
Parameters
agentId
string
Returns
boolean
isEscalatable()
isEscalatable(
filepath):boolean
Defined in: security/SafeGuardrails.ts:235
Check whether a filesystem path is eligible for permission escalation. Returns false for sensitive paths (credentials, keys, system files) that should never be granted through runtime requests.
Parameters
filepath
string
Returns
boolean
setFolderPermissions()
setFolderPermissions(
agentId,config):void
Defined in: security/SafeGuardrails.ts:205
Set folder permissions for an agent
Parameters
agentId
string
config
Returns
void
setTierPermissions()
setTierPermissions(
agentId,permissions):void
Defined in: security/SafeGuardrails.ts:219
Set security tier permissions for an agent
Parameters
agentId
string
permissions
delete
boolean
execute
boolean
read
boolean
write
boolean
Returns
void
validateBeforeExecution()
validateBeforeExecution(
request):Promise<GuardrailsResult>
Defined in: security/SafeGuardrails.ts:265
Validate tool call before execution Returns validation result with allow/deny + reason
Parameters
request
GuardrailsRequest
Returns
Promise<GuardrailsResult>