Guardrails are admin-authored rules that let Luna take action without a human-in-the-loop when conditions match, a more surgical alternative to broad "auto-approve" toggles. Every Luna tool now has four states: Allowed, Denied, Ask, and the new Guarded state, which only runs when your rule evaluates true.

Rules can reference attributes on the entity Luna is acting on, for example, "auto-approve membership additions to low-risk groups, but always ask for production resources." Permissions inherit from parent agents and playbook configs, with overrides shown explicitly on each tool so you always know which rule fired.

Configure under Settings → Luna → Guardrails.