GTM agent guardrails

The agent reads freely. Every write waits for a person. Nothing that cannot be taken back runs at all.

Banned: no CRM write without a prompt. An allow rule on a whole CRM server, or on a write tool, is refused.

The rules, each with its public source, are in references/guardrails-context.md. Read it before you change a settings file.

Start here, every time

Scoring needs no setup. If the user handed you a settings file or a gtm/guardrails.json, run the scorer first and report every line. Offer setup afterwards.