Spec
GUARDRAIL.md = YAML frontmatter + Markdown body.
The AI reads it at session start.
Where
.agents/guardrails/<name>/GUARDRAIL.md
or GUARDRAILS.md at project root.
IDEs
Works with Cursor, Claude Code, VS Code Copilot, Windsurf, Continue, and JetBrains.
Run npx guardrails-ref setup to add the rule so the AI reads your guardrails.
Other IDEs can implement the format — see client implementation.
Minimal example
---
name: no-plaintext-secrets
description: Never log, commit, or expose API keys, passwords, or tokens.
---
## Trigger
Adding logging, auth, or API integration.
## Instruction
- Never store or log plaintext credentials
- Use environment variables
## Reason
Secrets in logs lead to security incidents.Frontmatter
name and description required.
Optional: scope, severity, triggers.