Guardrail Layering: Input, Tool Call, Output

Take one Desk rule, which says that a refund above 200 dollars needs an employee's approval, and one customer message that asks for 900 dollars. Place the rule in two positions and compare the results.

In the first design, a check reads Desk's final reply and looks for an unapproved refund above the limit. It finds "I have refunded your 900 dollars" and blocks the sentence. The refund tool ran three steps earlier, however, so the money has already left.

In the second design, the same rule runs inside the refund tool, before the payment call