Class: SafeGuardrails
Defined in: security/SafeGuardrails.ts:171
Safe Guardrails - validates tool calls before execution
Constructors
Constructor
new SafeGuardrails(
config?):SafeGuardrails
Defined in: security/SafeGuardrails.ts:178
Parameters
config?
SafeGuardrailsConfig = {}
Returns
SafeGuardrails
Methods
addFolderRule()
addFolderRule(
agentId,rule):void
Defined in: security/SafeGuardrails.ts:249
Append a folder access rule to an agent's permission config at runtime.
If no config exists, creates one with defaultPolicy: 'deny'.
Parameters
agentId
string
rule
Returns
void
getFolderPermissions()
getFolderPermissions(
agentId):FolderPermissionConfig|undefined
Defined in: security/SafeGuardrails.ts:228
Get folder permissions for an agent (if configured).
Parameters
agentId
string
Returns
FolderPermissionConfig | undefined
getViolationStats()
getViolationStats(
agentId,timeRange?):Promise<{bySeverity:Record<string,number>;byTool:Record<string,number>;total:number; }>
Defined in: security/SafeGuardrails.ts:580
Get violation statistics for an agent
Parameters
agentId
string
timeRange?
end
Date
start
Date
Returns
Promise<{ bySeverity: Record<string, number>; byTool: Record<string, number>; total: number; }>
hasFolderPermissions()
hasFolderPermissions(
agentId):boolean
Defined in: security/SafeGuardrails.ts:214
Check whether folder permissions have been configured for an agent.
Parameters
agentId
string
Returns
boolean
isEscalatable()
isEscalatable(
filepath):boolean
Defined in: security/SafeGuardrails.ts:237
Check whether a filesystem path is eligible for permission escalation. Returns false for sensitive paths (credentials, keys, system files) that should never be granted through runtime requests.
Parameters
filepath
string
Returns
boolean
setFolderPermissions()
setFolderPermissions(
agentId,config):void
Defined in: security/SafeGuardrails.ts:207
Set folder permissions for an agent
Parameters
agentId
string
config
Returns
void
setTierPermissions()
setTierPermissions(
agentId,permissions):void
Defined in: security/SafeGuardrails.ts:221
Set security tier permissions for an agent
Parameters
agentId
string
permissions
delete
boolean
execute
boolean
read
boolean
write
boolean
Returns
void
validateBeforeExecution()
validateBeforeExecution(
request):Promise<GuardrailsResult>
Defined in: security/SafeGuardrails.ts:267
Validate tool call before execution Returns validation result with allow/deny + reason
Parameters
request
GuardrailsRequest
Returns
Promise<GuardrailsResult>