1. The evidence gap
Organizations adopted AI coding agents — Claude Code, OpenAI Codex, Cursor, and their peers — faster than they adopted any way to prove how those agents behaved. An agent that can read a repository, run commands, and touch company data is a system acting on the organization’s behalf. Ask most teams to produce a record of what their coding agent did last Tuesday, to which data, under whose authorization, and you get a shrug. That shrug is the evidence gap.
The regulatory calendar is closing that gap whether the market is ready or not. EU AI Act Article 50 — transparency for AI interactions and synthetic content — is in force as of August 2, 2026. The high-risk regime, with its record-keeping and logging obligations, arrives on the two-tier schedule set by the 2026 Digital Omnibus: December 2, 2027 for standalone Annex III systems and August 2, 2028 for high-risk AI embedded in regulated products (Annex I). Colorado’s SB 26-189 lands January 1, 2027 with three-year recordkeeping. None of these ask whether you bought a tool. They ask what you can show.
An agent guardrail is the runtime control that starts producing that record: software in the agent’s execution path that scans, inspects, blocks, or logs its actions against a rule set as they happen, emitting findings, block decisions, human-approval records, and durable exports. That is real, and it is more than a checkbox. But raw telemetry is not yet an answer — which is the whole point of this piece.
2. What runtime guardrails produce — findings, block decisions, human-in-the-loop approval records, and durable exports (SQLite / JSONL / OTLP / SIEM), with a worked example and one or two sanitized findings from a first-person operator trial.
3. The crosswalk table — the citable asset: agent-guardrail evidence types mapped to the referenced Persuasion-Exposure Validation (PEV) control (by identifier and public definition only), the enforcement signal it satisfies, and the EU AI Act clause it evidences — including the honest-gaps row for the signals a guardrail does not cover.
4. What a guardrail does not give you
The clearest statement of a guardrail’s limits usually comes from the guardrail vendors themselves. Cisco’s own scope language for DefenseClaw (as of version 0.8.10, July 2026) is blunt: a guardrail does not prove risk-free operation, and it must be used alongside human review, least-privilege configuration, and ongoing monitoring. Read that carefully — it is the SanctumShield thesis, stated by the tool’s maker. The control generates evidence; it does not certify the outcome.
So the guardrail hands you a stream of findings. What it does not hand you is the thing a regulator, auditor, or underwriter actually asks for:
- An owner. A finding nobody is accountable for is telemetry, not a control.
- A control mapping. A block decision that maps to no policy clause proves an event happened, not that a safeguard exists.
- A regulatory citation. A log that cites no obligation answers no questionnaire.
- A review cadence. Evidence nobody reviews on a schedule is a data-retention cost, not due diligence.
That is the layer separation, and it is not a criticism of the tools. Guardrails, SIEMs, and runtime detection are genuinely needed; an organization running coding agents without them is exposed. But needed is not the same as governed. Guardrails generate evidence. A governance program is what makes the evidence mean something — the chain from a raw finding to a named owner, a mapped control, a cited clause, and a dated review. Buy the tool and skip the chain and you have governance theater with better logging.
5. Where this goes
The durable asset is not the tool review — tools version and rot. It is the mapping: from the evidence a runtime guardrail produces, to the validation control it satisfies, to the regulatory obligation it helps you evidence. That crosswalk survives any single guardrail’s disappearance, and it is what turns a pile of agent logs into a governance artifact.
See the research and the controls behind SanctumShield’s approach at /under-the-hood, and the rendered artifact chain — AUP, Executive Risk Report, Board Memo, with independently verifiable URLs — at /sample-outputs.
Tool-specific claims are pinned to Cisco DefenseClaw version 0.8.10 (July 2026) and are reviewed quarterly for staleness; DefenseClaw is cited as one example of an agent-guardrail evidence source, and is never a runtime dependency of SanctumShield. Regulatory dates trace to primary sources — the full citation chain lives in the SanctumShield glossary and on /why-now, refreshed monthly.