guardrail

DE//AGENT currently lists 7 resources under guardrail: 5 hooks, 2 tutorials. Everything below is derived from the live registry — counts, capabilities, verification state and security posture come from the curated records, never from marketing copy.

Documented learning objectives across these resources:

• Configure a pre-commit check over staged schema files — via Enforce contracts in CI with the schema change check
• State what lets a breaking change pass — MIGRATION.md or a deprecated_at annotation — via Enforce contracts in CI with the schema change check
• Explain why the gate belongs in the producer's CI, not the consumer's runtime — via Enforce contracts in CI with the schema change check
• Install a pre-run gate that intercepts backfill triggers — via Gate backfills with the safety check hook
• State the three requirements the hook enforces before any backfill — via Gate backfills with the safety check hook
• Recognize a denied bare backfill command and what it was missing — via Gate backfills with the safety check hook

These resources map to stages: Data Quality (2), Orchestration (1), Reliability (3), Warehousing (1). Follow the four-phase roadmap to place this topic inside a progression instead of learning it in isolation.

Every entry, its shape and its trust state — sorted by the registry's composite score. This table is the honest version of a marketing comparison: no sponsored placements, no unverifiable claims.

How scores are computed: source quality score.

Highest composite score first:

1. Enforce contracts in CI with the schema change check score 34.15 — beginner
2. Gate backfills with the safety check hook score 34.15 — intermediate
3. Destructive SQL Guard score 33.6 — beginner

Scores rank provenance, completeness and trust — read how verification works before adopting anything.

Start here if you're new: Enforce contracts in CI with the schema change check, Destructive SQL Guard, Production Write Confirmation.

Reach for these with production experience: PII Leak Guard.

Security-flagged entries: dbt Full-Refresh Guard (1 flag), Schema Change Check (2 flags), PII Leak Guard (2 flags). Flags mean the record declares capabilities like credential use or write access — read the security posture on each page before connecting.

• Enforce contracts in CI with the schema change check — Install the Schema Change Check as a pre-commit gate over staged schema files so a breaking change exits non-zero unless a migration plan or deprecation annotation rides along with… details
• Gate backfills with the safety check hook — Wire the Backfill Safety Check as a pre-run gate that refuses any backfill lacking an explicit date range, a shadow or snapshotted target, and a window clear of the scheduled produ… details
• Destructive SQL Guard — Intercept DROP / TRUNCATE / DELETE-without-WHERE before an agent executes it. details
• Production Write Confirmation — Force human confirmation for any write against a production data target. details

Adjacent topics: hook (7 shared), tutorial (2 shared), contracts (2 shared), safety (2 shared).

Study path: the roadmap places this topic in a progression · the scoring model explains the numbers · the trust rule catalog shows every security check these entries passed through.