A guardrail is applied only to final text, but tools can mutate records during execution. What is missing?

1. A new agent avatar
2. A longer final answer
3. Checks at relevant inputs, tool calls, tool results, and consequential execution boundaries
4. More unrestricted agents