Ai Agent Guardrails Windows Guide

Guide: a global guardrail against catastrophic commands, for AI agents on Windows (Claude Code + Git Bash)

**The problem this guide solves**: you let an AI agent (Claude Code or another) run shell commands on your Windows machine, sometimes autonomously. One day, by accident — a misread instruction, a badly built path, a hallucination — it will attempt something irreversible: `rm -rf /`, a `git push --force`, a `Remove-Item -Recurse` on the drive root. This guide installs a **global guardrail**: a list of catastrophic command patterns, checked by a hook *before every execution*, which blocks the command and tells the agent why.

**Verified working** configuration (Windows 11, Claude Code 2.1.x, Git for Windows, July 2026), including the end-to-end test: a real agent session asked to run `git push --force` gets blocked by the hook before git even starts.

**This guide exists because the Unix recipe does not work as-is on Windows.** The concept (a shared denylist plus a PreToolUse hook that exits with code 2) comes from [David Ondrej's `global-agent-guardrails` skill](https://github.com/davidondrej/skills/tree/main/skills/ops-and-setup/global-agent-guardrails) (MIT), designed for macOS/Linux. Installed naively on Windows, the guardrail **looks like it is in place but blocks nothing** — the worst possible failure mode for a safety tool. The scripts in this guide are an original reimplementation that fixes two very real Windows pitfalls, documented below.

**What this guardrail is — and is not.** It is a seatbelt against *accidents*. It is **not** a sandbox against a malicious agent: trivial obfuscation (`python -c "shutil.rmtree(...)"`) sails past a regex. If your threat model is a hostile agent, you need isolation (VM, container, dedicated account), not a denylist.

**Where this fits**: part of a Windows agent-tooling set — [orchestrating agents with tmux in WSL2](https://github.com/AI-Architect-Lab-333/windows-tmux-agent-orchestration) runs several agents at once