The Best AI Coding Guardrail Isn't a Prompt. It's Code the Model Can't Override.

Most AI coding agents hand you a system prompt and a leash. You tell it which files to leave alone, which commands not to run, how much it's allowed to spend, then hope the model listens. A Laravel package released last week, Laravel Tackle, skips the hoping.

Written by Jordan Dalton and covered by Laravel News on August 20, Tackle runs an AI coding agent as Artisan commands inside your own application. Because it boots with the framework, it reaches for the same tools you would: list your routes, read a Telescope exception, run a query, call Pint once it's done editing. That's the convenient part. Where it gets interesting is where the limits live.

The guardrails are PHP, not English.

Path restrictions, the command allowlist, and the per-session spend cap live in PHP, inside the package itself. Not in a prompt the model has to agree to follow. Small distinction, except it isn't: a prompt is just a sentence the model reads and interprets, the same way it reads and interprets a hostile comment sitting in your issue tracker or a cleverly worded exception message. That's the whole mechanism behind prompt injection and jailbreaks. The rule and the attack arrive through the same door, and the model has to keep choosing to obey the rule every single time. Choosing is the thing these attacks are built to break.

Code doesn't get a vote. Tell the allowlist the agent can't run migrate:fresh in production, and the model has no more luck arguing past that than it does arguing past a type hint. The boundary isn't part of the conversation. It's outside it, where the model can't reach.

We've been writing about this failure mode all summer.

An AI coding tool got caught uploading whole repositories to a vendor's servers by default, because "improve the model" was a toggle in a settings menu, not a real technical limit. An AI agent leaked private repositories from a public comment because it treated a stranger's text like an instruction worth following. Different vendors, different mechanisms, same root cause: the safety boundary lived in language, and language is negotiable.

Tackle's self-healer is a decent stress test of the alternative. It watches for failed queue jobs and scheduled tasks, patches the code in an isolated git worktree, and opens a pull request instead of pushing straight to your branch. Even on the fully autonomous path, the blast radius is capped by where the process can write. The model's mood has nothing to do with it.

Five agents, one framework.

Tackle ships five commands on top of the official laravel/ai package. ai:code is an interactive session with plan mode and history. ai:run is the same agent with no terminal attached, built for pipelines. ai:fix starts a focused session from a pasted exception, a Sentry issue, or a GitHub issue number. ai:review reads a diff and posts inline comments with severity levels. ai:upgrade walks a Composer package across a major version using its own upgrade guide. A companion package, Tackle Remote, puts the same harness behind a mobile browser UI with approval prompts.

It defaults to Claude, but AI_CODE_PROVIDER will point it at OpenAI, Gemini, Groq, or a local model through Ollama, two environment variables and you're done. Aim it at Ollama, and two more variables, AI_CODE_PRICE_INPUT and AI_CODE_PRICE_OUTPUT, drop the per-token cost to zero, because the built-in price catalog has no rate for a model that isn't billed at all. Small detail. Also the kind of detail that tells you the spend cap was built as a real financial control, and somebody actually thought through the local-model case.

That provider flexibility matters for a separate reason. A safety design that only works because you trust one vendor's alignment training breaks the day you switch vendors, or the day that vendor's model behaves a little differently under load. Tackle's guardrails don't care which provider you're running. They were never the provider's job to enforce in the first place.

The question worth asking before you buy anything AI-branded.

Most businesses evaluating an AI tool ask what it can do. Ask where its limits live instead. If the answer is "somewhere in the system prompt," you're trusting a sentence to hold up under pressure, whether that's a bad actor or just a weird edge case nobody tested for. If the answer is "in code that runs no matter what the model decides," the tool fails closed instead of failing open.

It's the same question we walk clients through when we build AI development into a piece of custom software: does the surrounding application give the model exactly the access it needs and nothing more, enforced in code? "Our AI can do anything" is the more exciting sentence to put on a website. It's also the one that stops holding up the first time someone tries something nobody thought to prompt against.

Worth saying plainly: none of this makes Tackle bulletproof, and it doesn't make any code-enforced guardrail bulletproof either. You can still write a path allowlist too loosely. You can still set a spend cap too high to matter. What Tackle gets right isn't a solved problem, it's a starting assumption: treat the model like a capable but occasionally unpredictable collaborator, and keep the things that can do real damage out of its reach unless the application, not the prompt, says otherwise.