guardrails belong in the server
the >$50 refund rule lives inside the MCP server, not the agent. here is why that is the only place it survives contact with a real caller.
read the note
every layer of sentinel can say no — the classifier, the supervisor, the QA agent — but the rule that actually stops money is the refund ceiling: anything above $50 waits for a human. I first put that check in the orchestration code, because that is where the decision felt like it happened.
then I wrote a second client that called the action tool directly. the check was gone. orchestration-level guardrails are suggestions to anyone holding the endpoint — another agent, a script, my future self at 2am. moving the rule into the MCP server made it non-optional: every caller passes through it, and the 50-ticket sweep ends with 0 unsafe actions.
the lesson I keep re-learning: put safety where the capability is, not where the reasoning is. anything a client can skip, a client will skip.