An agent's guardrails only work inside the agent. The commands it leaves behind run later, in your terminal and your CI, with your keys. So I put the guardrail in the task runner, then tried to break it.
AI Guardrails Belong in Your Task Runner: I Built a Tool to Stop Supply Chain Attacks