M-12 names ten malicious cases: hidden instructions in attachments and in supplier answers. In lesson 1.5 the question was what a deceived agent may do, in 4.1 whether the gate lets it through, in 4.3 how to find such deceptions early. This lesson asks: Where do you catch the attempt itself, at which of the four points of an agent run, and with what? F-05 demands a guardrail per agent at the four intervention points as far as Learn supports it, and hard rules in the code, never only in the guardrail.
Prior knowledge. Categories, blocking levels, Prompt Shields and the handling of a refusal (HTTP 400 content_filter, finish reason ContentFilter): "AI track, lesson T6.3". Hard rules in the code: "AI track, lesson T6.4". Controls, precedence rule, oversight modes and the Bicep sketch of a guardrail: "AI-103, lesson 1.5"; none of that is repeated. The authorization matrix: lesson 1.5 of this course; the gate: 4.1; scans: 4.3.
New in this lesson. Each agent role gets a guardrail gr-<agent> (so gr-planer to gr-pruefer), built from a common template so that differences can be changed later without effect on the others. The travel assistant from AI-103 keeps reiseassistent-streng. A blocked point ends the run at the trip planner; it is never repeated (M-02, lesson 2.6).
The requirement
All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 4.4-01 | Each of the seven agents has a guardrail of its own with controls at input and output. | R | 7 of 7 | Must | F-05 |
| 4.4-02 | For every agent with tools, tool call and tool response are checked, in the service or in the code. | R | 5 agents, 0 gaps | Must | F-05 |
| 4.4-03 | No hard rule (R-02, no A3, A2 only with approval) depends on the guardrail. | R | 0 rules only in the guardrail | Must | M-05, F-05 |
| 4.4-04 | A blocked point ends the run and is not repeated. | R | 0 repetitions | Must | M-02 |
| 4.4-05 | Every assigned guardrail is backed by a case that must be blocked. | R | 7 of 7 | Must | AI-103, 1.5 |
| 4.4-06 | The waiting time caused by guardrails is measured. | Q | per point, in the run | Should | M-02 |