Guardrails

Prerequisites

• The project exists. Open Settings → Guardrails.

Steps

The section says "Globs the coding agent must never modify. Requests that need these files are classified as large."

A request that has to change a matching file is held as Needs a quote. The classification reason is "The change touches a protected path, so it needs a quote." If a run still produces a protected path or deletes a file, the request is Review required and Autopilot will not merge it. The reason lines start with "Protected path:" or "Deleted file:". Approve & merge then says "Review required — merge on GitHub."

The agent is also told not to write those paths.

Defaults

A new project copies this list, then adds matching folders it finds in the repository (auth, login, session, billing, stripe, checkout, payment, webhook, models, migrations, alembic, and middleware files).

• .env* and **/.env*
• .github/**
• **/*.pem and **/*.key
• package.json, package-lock.json, pnpm-lock.yaml, yarn.lock
• requirements.txt, Pipfile*, poetry.lock
• vercel.json, Procfile, app.json, Dockerfile, docker-compose*
• **/auth/**, **/auth.*, middleware.*
• **/login/**, **/session*
• **/billing/**, **/stripe/**, **/payment*/**, **/checkout/**, **/webhook*/**
• prisma/schema.prisma, prisma/migrations/**, migrations/**, alembic/**
• **/models.py, **/db/migrate/**

The section mark stays green. Guardrails are not a setup check.

Change the list

1. Type a glob. The placeholder is src/legacy/**. Press Add, or press Enter.
2. Press Remove on a line to drop it. The button name is "Remove" plus the path.
3. Press Save.
4. Reset to defaults rebuilds the list from the built-in paths and the repository tree.
5. Add AGENTS.md opens a pull request that adds AGENTS.md at the repository root, including the protected paths. After that pull request exists, the button is replaced by AGENTS.md PR # and the number.

Verify

A request that needs a protected file lands on Needs a quote, or later shows Review required with a "Protected path:" line. A text change that does not touch those paths still proceeds under the current Autopilot mode.

Troubleshooting

• Autopilot skipped a change you expected to ship. Open the request and read Review required. A protected path or a deleted file always waits.
• Reset to defaults removed a path you added. Add it again and press Save.
• The client still sees a quote for a small visual change. The files the agent would edit match a glob on this list. Narrow the glob, or handle that request with a quote.