Tool Guardrails — References

The principle that a check must be unbypassable, the classic gap between checking and acting, and the transaction literature behind reversible execution.

Mediation

• The Protection of Information in Computer Systems — Jerome H. Saltzer and Michael D. Schroeder, Proceedings of the IEEE, 1975. Cited here specifically for complete mediation: every access must be checked, and a design in which some paths reach the resource without passing the check provides the protection of its weakest path rather than of its strongest. Cited by name.
• OWASP Top 10 for Large Language Model Applications — the entry on excessive agency, which frames the risk as the gap between what an integration technically permits and what the task actually requires. Cited by name.

Checking and then acting

• Checking for Race Conditions in File Accesses — Matt Bishop and Michael Dilger, Computing Systems, 1996. The canonical treatment of time-of-check to time-of-use, which is the formal version of a preview and an execution being two separate operations against a target that is free to change between them. Cited by name.

Reversible and compensating execution

• Sagas — Hector Garcia-Molina and Kenneth Salem, ACM SIGMOD, 1987. Long-running work decomposed into steps each of which has a compensating action, which is the structure a multi-step agent run needs if a guardrail firing partway through is to leave anything recoverable. Cited by name.
• Transaction Processing: Concepts and Techniques — Jim Gray and Andreas Reuter, Morgan Kaufmann, 1993. The reference treatment of atomicity, idempotence, and recovery, which is the vocabulary for arguing about what a retry after a denial actually does. Cited by name.

No verified reference is recorded for argument-level policy over language-model tool calls, for run-scoped budget enforcement in agent systems, or for effect previews as a guardrail input. The practice exists in deployed systems and has not been written up in a form worth citing.