What are the best guardrails for AI coding agents?

Layer them: a short, current rules file (AGENTS.md / CLAUDE.md); an explicit task scope checked against the diff; locked behaviours that prove features still work; agent permissions for risky commands; tests in CI; and human or AI review of the pull request. Stet covers the scope, locked behaviours and keeping the rules file current, for any AI tool.

Is AI code review enough to catch AI coding mistakes?

No. Review happens after the change and depends on the reviewer spotting intent violations. Deterministic checks (scope, locked behaviours) catch those before review, so reviewers focus on design.

Guide · Comparison

Guardrails for AI coding: approaches and tools compared

Updated 15 Nov 2026 · 6 min read

There is no single switch that makes AI coding agents safe. Each guardrail catches a different failure. Here is what each one does well, what it misses, and how they fit together.

Approach	Catches	Misses
Rules files AGENTS.md, CLAUDE.md, Cursor rules	Sets intent and conventions up front.	Nothing verifies it was followed; goes stale.
Tests and CI	Broken behaviour that a test covers.	Gaps in coverage; tests edited by the agent; files changed outside the task; runs late.
AI code review bots	Bugs and style issues in the diff, with explanations.	Runs after the fact; can't know which files the task was allowed to touch; probabilistic.
Agent permissions and hooks built into tools like Claude Code	Blocks risky commands and actions inside that one tool.	Tool-specific; not a shared definition of the task or of what must keep working.
Stet	Files changed outside the agreed task; locked behaviours that broke; snapshot output that changed; edited approved snapshots. Works across tools.	Needs you to set a scope per task and lock the behaviours that matter; it doesn't review code quality.

A layered setup that works

Before the task: a short, current AGENTS.md (Stet generates its block) and an explicit scope: stet scope set "<task>" --allow "<globs>".
During the task: your agent's own permission settings for risky commands; Stet's MCP tools let Claude Code and Cursor check scope and locks themselves.
After the task: stet guard and stet check, then commit (stet scope done --commit).
At commit and in CI: the Stet pre-commit hook and your test suite.
At review: a human or AI reviewer, now looking at a diff that is already in scope and passing its locks.

When Stet is the right fit

You use more than one AI tool (say Claude Code and ChatGPT) and want one set of rules and checks across them.
Agents keep "tidying" code outside the task, or breaking a feature you thought was safe.
You run several codebases (as a fractional CTO or agency) and need the same guardrails everywhere.
Your code must stay local: Stet has no account, no telemetry and is MIT-licensed.

Add the missing layer

npx stet-cli init · Setup guide · GitHub