This glossary defines the terms people confuse around guardrails for AI agents and software delivery: policy, gate, guardrail, scope, sandbox, tool, proxy, approval, agent identity and audit log. Each entry says what it is, what it is not, and one way it shows up in practice.
Core terms
Guardrail. An enforced boundary on what an agent or pipeline can do. It is applied outside the model or code that is being limited. Not the same as a prompt that asks the model to behave.
Policy. A written rule, ideally machine readable. "No dependency with a known malicious flag may ship." A policy alone enforces nothing.
Gate. A checkpoint in a delivery pipeline that passes or fails a change based on policy. Gates apply at commit, pull request, build and release.
Control. The general word for any safeguard. Gates and guardrails are kinds of control.
Scope. The set of things an identity may touch, such as repositories, folders or tools. Narrow scope means less damage when something goes wrong.
Least privilege. Giving an identity only the access its task requires. The principle behind most guardrails.
Agent terms
Agent. Software that uses a model to plan and take actions, often through tools, with some autonomy.
Tool. A function an agent can call: read a file, query a database, open a pull request. Tools are where an agent's power lies, so most limits attach to them.
MCP (Model Context Protocol). A common way for agents to discover and call tools served by a separate program. Because many agents use it, it is a natural place to apply rules.
Proxy. A component placed between an agent and its tools that can inspect, allow, deny or log calls. It limits agents without changing them.
Agent identity. A distinct, trackable identity for each agent, with its own credentials and recorded access. Replaces the habit of using a developer's personal token.
Prompt injection. Hostile instructions hidden in content an agent reads, such as a web page or file, aimed at steering it. A defensive concern: assume it will happen and limit what a steered agent can do.
Delivery terms
Pipeline (CI/CD). The automated path from source to production.
Release gate. The last check before software reaches users, often including approvals.
Software bill of materials (SBOM). A list of the components inside a piece of software. Supports questions like "do we use this package?"
Provenance. Evidence of where an artifact came from and how it was built.
Reachability. Whether code in your application can actually call a vulnerable function. Helps rank findings.
Oversight terms
Approval. A human decision required before a sensitive action. Should name the approver and be recorded.
Warn mode. A rule reports violations without blocking. Used to tune before enforcement.
Exception. A permitted deviation, with an owner and expiry date.
Audit log. A record of what happened: who or what, did what, when and with what result.
Fail closed and fail open. What happens when a control cannot decide or is unreachable. Closed blocks the action; open allows it. Pick consciously.
Terms often confused
- A scan finds problems; a gate acts on them.
- A sandbox isolates where code runs; a scope limits what an identity may reach. You often want both.
- Guardrails for agents and LLM firewalls overlap, but a firewall inspects model inputs and outputs, while many guardrails limit actions regardless of text.
A constructed example using the terms
An agent (with its own identity) can use three tools through an MCP proxy. Policy says it may read the repository and open pull requests. The proxy denies a merge call and logs it. A gate in the pipeline requires a human approval for the release. The audit log shows each step.
Where Safeguard fits
Safeguard offers policies, gates and guardrails enforceable at build, CI and release, an MCP Guardrail proxy for MCP servers, and agent identity tracking for which agent holds what access at what level. An AI Gateway or LLM firewall is in early access.
What to do
- Pick the five terms your team uses inconsistently and agree one definition each.
- Put them in your engineering handbook.
- Check contracts and vendor pages use the terms the same way.
- Review whether each guardrail is enforced outside the thing it limits.
Quick check
What is the difference between a policy and a gate?
A policy states the rule. A gate enforces it at a point in the pipeline by passing or failing a change.
What does fail closed mean?
If the control cannot make a decision, the action is blocked rather than allowed.
Sources
These are general engineering definitions. No external standard was fetched, so check the Model Context Protocol specification and OWASP LLM guidance directly for their exact wording.
Last reviewed: 18 October 2026.
