How do you decide where to place guardrails in a multi-step agent workflow?

Example Answer

I place guardrails at the points where control meaningfully changes: before high-risk planning decisions, before tool execution, after untrusted retrieval, at approval boundaries, and before final user-visible actions or disclosures.

I do not want one giant guardrail only at the end. In multi-step workflows, safety can fail long before the final answer if a bad retrieval result, wrong tool choice, or unsafe state transition slips through.

Good placement follows the risk path of the workflow. The guardrails should exist where they can still change the outcome, not only where they can describe what already went wrong.

Concrete example

For a document-to-email workflow, enforce source access during retrieval, validate the recipient and permitted content before sending, and bind confirmation to the exact outbound message.

Limit to explain

Checks after execution cannot prevent the earlier send. Additional checkpoints add latency, so use controls whose location matches the specific failure they can prevent.

Follow-up to practice

Which decisions need another check immediately before execution?

Worked practice case

Reading D is allowed only after the retrieval service checks U's current document permission. Drafting a public summary is a proposal and still requires checking the permitted disclosure scope. Sending D to X is denied: retrieved instructions do not grant recipient or content authorization. Enforce recipient and disclosure checks in the send service before any outbound operation, and bind any required approval to the actual recipient/body/attachments. A final-answer warning after transmission is too late. Log identifiers and decisions without unnecessarily duplicating the sensitive document.