ToolGuardrail

Tool this rule targets: the exact (namespaced) tool name (‘reply_guest’, ‘booking__create_booking’), a wildcard suffix (‘booking__’), or '' for every tool.

allow = run autonomously; judge = LLM judge evaluates; require_approval = human must approve first; suggest = shown to a human as a draft they send themselves (reply_guest); deny = the tool is blocked (filtered from binding when the rule is static, rejected per-call when arg conditions apply).

Conditions (AND’d). Empty list = the rule always matches this tool.

Human-readable why — surfaced in audit events and in the blocked-call message.

Optional judge rules override, used when action=‘judge’ (or as the ALWAYS pre-check rules for require_approval). None falls back to the tool’s built-in semantic_checks.