Guardrails and Human in the Loop · ai-skills

Reference: Agentic Workflows for Chip Teams · Beginner to Intermediate

Guardrails bound what an agent may do without asking. Each action passes a policy check, and risky actions pause for a person.

Tier	Agent may	Example in chip work
Read	Read named sources	Read `rtl/alu.sv` and a lint report.
Propose	Draft text with no side effects	Draft a fix plan for review.
Write to scratch	Write inside one scratch directory	Write `scratch/trial1/notes.txt`.
Write to repo	Change tracked sources after approval	Edit `rtl/alu.sv` on a branch.
Run jobs	Start named jobs after approval	Start the `lint` job.

Policy check with allow, approval, and deny paths.

Every proposed action passes one policy check with three outcomes.

Lesson	What it covers
Permission tiers and least privilege	The five tiers and a runnable policy checker.
Sandboxing and approval gates	Containment for runs and gates for risky actions.
Rate, cost limits and audit logs	Budgets with worked arithmetic and per-action logs.
Secret handling	What counts as a secret and how to keep it out.
Prompt injection from files and logs	Injected instructions in content and limits on damage.

Check yourself An agent wants to edit a tracked file. Which tier is that, and may it proceed on an allow verdict alone?

Write to repo. It may not proceed alone; that tier needs a recorded human approval first.

Tier

Agent may

Example in chip work

Read

Read named sources

Read rtl/alu.sv and a lint report.

Propose

Draft text with no side effects

Draft a fix plan for review.

Write to scratch

Write inside one scratch directory

Write scratch/trial1/notes.txt.

Write to repo

Change tracked sources after approval

Edit rtl/alu.sv on a branch.

Run jobs

Start named jobs after approval

Start the lint job.

Lesson

What it covers

The five tiers and a runnable policy checker.

Containment for runs and gates for risky actions.

Budgets with worked arithmetic and per-action logs.

What counts as a secret and how to keep it out.

Injected instructions in content and limits on damage.