Guardrails add overhead. Every check is a new failure mode. For a code-generation agent, the "best" configuration is the one that doesn't make the agent useless while still catching the high-probability, high-impact threats.

Start with the obvious: block direct system calls, file writes outside sandbox, network egress. That's basic containment. The hard part is the semantic layer. If you set sensitivity too high on "insecure code" patterns, you'll block every `eval()` or `os.system` example a user legitimately asks to be explained. If you set it too low, you'll miss the obfuscated payload.

My approach: define the real threat model first. Is the user malicious or is the agent being tricked? Is the risk data exfiltration, system compromise, or just bad code? Tune for that. Logging every guardrail event for "analysis" creates a privacy problem—you're now storing a transcript of every user's failed attempts, which could be sensitive. Either sample logs aggressively or don't log the prompt content at all.

mw