---
title: "Guardrails"
description: "Hooks and checks that enforce the rules instead of asking for them."
canonical_url: "https://razcue-agent-kit.vercel.app/en/concepts/guardrails"
---
# Guardrails

> Hooks and checks that enforce the rules instead of asking for them.

Four hooks and a few scripts do the checking. They are silent outside agent-kit projects and take about 70–100 ms each. Full list in [Hooks](https://razcue-agent-kit.vercel.app/en/reference/hooks).

## Git guard

A `PreToolUse(Bash)` hook applies the git flow you chose, even through `bash -c`, `eval`, `$( )` and git aliases:

<table>
<thead>
  <tr>
    <th>
      Flow
    </th>
    
    <th>
      The agent may
    </th>
    
    <th>
      Blocked
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      <strong>
        Read-only
      </strong>
    </td>
    
    <td>
      read (<code>
        status
      </code>
      
      , <code>
        diff
      </code>
      
      , <code>
        log
      </code>
      
      , …)
    </td>
    
    <td>
      every git write — the agent hands you the exact command
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Branches + PRs
      </strong>
    </td>
    
    <td>
      commit on a feature branch
    </td>
    
    <td>
      commits / pushes on the main branch
    </td>
  </tr>
  
  <tr>
    <td>
      <strong>
        Trunk
      </strong>
    </td>
    
    <td>
      commit on main
    </td>
    
    <td>
      —
    </td>
  </tr>
</tbody>
</table>

Every flow blocks force-push, `reset --hard`, `clean -f`, `branch -D` and `--no-verify`, and the guard validates `git commit -m` messages before they run. Permission rules in `.claude/settings.json` are the first layer; the hook is the backstop.

## Preflight

`agent-kit preflight [base]` (and the `preflight` skill) before a merge:

- **Violations (block)**: changed logic without a test (SDD + TDD), an edited committed migration, grants to the browser roles, possible secrets, undocumented kept scripts, done changes with uncovered scenarios or not merged into the living specs.
- **Report**: migrations to apply, new env vars, new dependencies.
- **Warnings**: debug leftovers, living-spec gaps, notation errors, a stale QA checklist, migrations without seed / purge changes.

## Commits

With Conventional Commits, `init` adds commitlint + husky. The `commit` skill runs preflight, writes the message, checks it with `agent-kit commit check` and commits within the git flow — or gives you the command in a read-only project. `agent-kit commit draft` groups changed files by suggested scope.

## Reviewer

A read-only `reviewer` agent reviews a diff against its change: every scenario's proof, the EARS requirements, the knowledge rules, and correctness bugs (scope checks, rounding, idempotent migrations).


## Sitemap

See the full [sitemap](https://razcue-agent-kit.vercel.app/sitemap.md) for all pages.