Every Guardrail Has a Floor: Deployment Limits of Action Guardrails from the Summary They Read

An agent about to send money or delete a file is checked by an action guardrail. Most guardrails decide from a summary of the call: which tool is being used, what kind of resource it touches, how far the effect reaches. Whether the call is an attack turns on a fact the summary leaves out: whether the user asked for it, or an attacker planted the instruction in a document the agent read. In the traffic we study the same bank transfer appears twice, once requested and once injected, with identical summaries. Such a collision has a price that can be computed in advance. From the summary a guardrail reads and a labelled sample of deployment traffic, without its corpus and without its weights, we derive a ceiling on the area under the receiver operating characteristic curve (AUROC) it can reach, a floor on the share of attacks it has to allow at a given retention of ordinary traffic, and the classes of action it has to allow every time. None mentions a model, so they bind every guardrail on that summary at once, no training moves them, and an attacker can read the third off the deployment without querying it. On $2,313$ AgentDojo actions, the tool-name allowlist agent platforms commonly run has to allow $40\%$ of attacks that already succeeded, at $83\%$ retention of ordinary traffic; a static runtime rule $72\%$. A guardrail certified at recall $1.000$ on a benchmark reaches an AUROC of $0.42$ here, of which retraining recovers only the part its corpus caused. The rest is one field: supplying where the instruction came from moves four language-model judges from an average AUROC of $0.67$–$0.75$ to $0.90$–$0.98$, and a three-valued code carries as much of it as the user's entire task description.