# Agent Safety

> Use when editing Open Horizons agent runtimes, tools, orchestration, or policy code that requires safety and governance controls.

- Skill: `paulasilvatech/agent-safety` (Agent Skill)
- Install (CLI): `npx skillmds@latest add paulasilvatech/agent-safety`
- Raw SKILL.md: https://api.skillmd.com/api/skills/paulasilvatech/agent-safety/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: paulasilvatech (https://skillmd.com/u/paulasilvatech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/paulasilvatech/agent-safety

---


<!-- Generated from harness/github-copilot/plugins/open-horizons-platform/instructions/agent-safety.instructions.md by harness/claude-code/scripts/convert_from_copilot.py. Edit the source, not this file. -->

# Agent Runtime Safety

These rules apply to executable agent, tool, orchestration, and policy surfaces. Copilot primitive Markdown is governed by the primitive-authoring instructions instead.

## Conventions

- Treat model output, tool arguments, remote content, checkpoint data, and MCP responses as untrusted input.
- Authorize every tool call at execution time using the authenticated actor, service identity, requested operation, target, and environment.
- Deny on missing identity, policy failure, malformed arguments, ambiguous scope, exhausted budgets, or unavailable approval evidence.
- Keep delegated agents within the caller's effective permissions, budgets, and data boundary.
- Require explicit human approval for deployments, destructive operations, privilege changes, external publication, and other high-impact mutations.
- Bound iterations, tool calls, payload sizes, timeouts, retries, and result sizes.
- Keep secrets, credentials, raw prompts, customer content, and sensitive tool results out of logs. Record correlation IDs, policy versions, decisions, and redacted evidence.
- Preserve append-only audit evidence for authorization, approval, tool execution, and policy decisions.
- Keep read-only and mutating tools distinct; a read-only route must not gain mutation through generic shell, HTTP, or MCP access.
- Test allow, deny, malformed, unavailable-policy, replay, and approval-expiry paths without live credentials.

## Verification

- Safety checks execute immediately before the protected action and fail closed.
- Tests prove that delegation, retries, and alternate tool transports cannot bypass authorization.
- Audit records are useful for correlation without containing sensitive payloads.

## Do / Do Not

| Do | Do not |
| --- | --- |
| Follow the conventions and execute the verification checks above. | Bypass the owning contract or report an unrun check as passed. |
| Keep changes inside the matched scope and preserve approval boundaries. | Expand into unrelated files, credentials, or live mutation. |

## Checklist Before Opening a PR

- [ ] The change matches this instruction's `applyTo` scope.
- [ ] Existing safety and authorization boundaries are preserved.
- [ ] Focused allow, deny, malformed-input, and bypass tests pass.
- [ ] Logs and errors contain no credentials or sensitive payloads.
- [ ] No unrelated edits or unresolved placeholders remain.