AI Agents Irreversible Guard — Data skill for Claude Code

ai-agents-irreversible-guard

**A two-tier guardrail that stops AI agents from doing irreversible damage — and gets out of the way for everything else.**

Most agent safety setups give you two bad options: approve every single tool call, or turn approvals off and hope. `ai-agents-irreversible-guard` is a `PreToolUse` hook that asks a different question before a command runs — **not "is this dangerous?" but "is this recoverable?"** — and routes accordingly:

• 🛑 Irreversible (rm -rf ~/Documents, DROP DATABASE, deleting a Supabase project or an R2 bucket, removing branch protection, editing the guard itself) → hard stop. Only a human unlocks it.
• ⚠️ Recoverable but expensive (force-push to main, deleting a repo, sending an email, moving money) → the agent re-confirms itself, in writing, against a checklist, and the whole thing is logged.
• ✅ Everything else — including deleting things the agent itself created two minutes ago, or anything sitting in a 30-day trash — runs with zero friction.

Measured on real history: **41,417 replayed Claude Code tool calls → 10 confirmations asked, 0 false stops.** **24,162 Codex tool calls → 0 interruptions.** 668 automated tests. ([How we measured](#benchmark-41417-real-tool-calls-replayed))

One honest sentence before anything else: **this guards against agent mistakes, not against a determined attacker.** A denylist is bypassable by construction — see [SECURITY.md](SECURITY.md). The real net underneath is still your trashes, your backups and narrowly-scoped tokens.

---

Table of contents

• Why this exists
• The doctrine (read this before the code)
• Recovery windows by service — the map the guard uses
• What a refusal actually looks like
• The two unlock paths
• [Friction decay (exponential backoff)](#friction-de