GuardrailMiddleware

Sees the run's final answer: returns it, possibly changed, or Left to fail the run.

Sees the run's input before anything else runs: returns it, possibly changed, or Left to fail the run.

Middleware this one must run inside of (be wrapped by); each must be registered in the same stack.

Middleware this one must run outside of (wrap); each must be registered in the same stack.

Tools this middleware contributes; they join the loop's tool set and are validated like any other.

Wraps one model call. A wrapper may rewrite the request (inject a note, filter tools), call next more than once (retry, fallback), transform its result, or return Left, which fails the run. A model wrapper cannot suspend.

Filtering ModelRequest.tools shapes what the model is offered and is not a permission control: a tool the model calls anyway still runs through wrapToolCall, where denial belongs.

Wraps one tool call, after its arguments were validated. A wrapper denies with ToolOutcome.Error("Denied: ..."), asks for approval with NeedsApproval(reason) (unless context.approved), fails the run with Fatal, and short-circuits by not calling next. It may call next more than once (retry) and transform the outcome next returns.

The state keys this middleware's wrapToolCall may add to a Success update.

This middleware's identifier, unique in its stack; must match [a-zA-Z0-9_-]{1,64}.