UiPath · gabrielavaduva · Jul 24, 2026 · Jul 23, 2026 · Jul 23, 2026 · Jul 23, 2026
@@ -14,6 +14,11 @@
 
 > Full three-fetch mandate applies to **Recommend mode**. In **Validate mode** of an existing guardrail the SDK docs are the authoritative, sufficient source for a validator's scope/stage — `catalog` (relevance metadata) and `list` (tenant entitlement) are recommended cross-checks, not a hard prerequisite for a scope/placement fix. See [Validate Mode](#validate-mode).
 
+**Required first operation in both modes:** use `WebFetch` on
+`https://uipath.github.io/uipath-python/core/guardrails/` before catalog calls,
+project inspection, analysis, or edits. A coded guardrail recommendation or
+validation is not grounded until this WebFetch has completed.
+
 ### Catalog (cacheable — 30-minute TTL)
 
 The catalog is the same for all tenants (authored metadata, rarely changes). Cache it locally for 30 minutes to avoid redundant calls.
@@ -192,7 +197,7 @@
 | `map-enum` (e.g. `entityThresholds`) | Dict from enum member → number (e.g. `{PIIDetectionEntityType.EMAIL: 0.5}`) — keys must exactly match the `enum-list` parameter's values |
 | `number` (e.g. `threshold`) | Plain `float` / `int` constructor argument |
 | `text` (e.g. `guardrailText`) | Plain `str` constructor argument |
 | `enum` (e.g. `model`) | `str` value from the allowed options list. When the catalog shows an empty options list (as with `llm_as_judge`'s `model`), run `uip agent guardrails llm-as-judge-models --output json` and use a `ModelId` from the result. Ask the user for a model ID only if the command returns nothing or fails. |
 | `text-list` (e.g. `positiveExamples`, `negativeExamples`) | `List[str]` constructor argument |

 Use `BlockAction(...)`, `LogAction(severity_level=...)`, or `EscalateAction(app_name=..., app_folder_path=..., recipient=...)` for human-in-the-loop review — or any other action the SDK docs expose. Never invent action class names. For `EscalateAction`, the fetched SDK docs must expose the class/parameters, and the Action App must be deployed and declared in `bindings.json` using [../../lifecycle/bindings-reference.md](../../lifecycle/bindings-reference.md) (see [guardrails.md § Escalation action (HITL)](guardrails.md#escalation-action-human-in-the-loop)).

@@ -66,6 +66,36 @@ From `agent.json`, extract:
 
 Also read `resources/` to list all tool names (needed for Tool-scope recommendations).
 
+### Exact Named-Tool Deterministic Rules — before catalog ranking
+
+When the request gives both a named Tool and an exact mechanical predicate on
+its input or output (literal word/phrase, regex, number, boolean, or always),
+use the custom deterministic recipe below. This decision happens before
+built-in catalog candidate ranking:
+
+1. Treat quoted text and a distinct all-caps token such as `CONFIDENTIAL` as
+   an exact literal predicate, even when the surrounding request is phrased
+   semantically (for example, "worried it might publish CONFIDENTIAL content"
+   or "what guardrails should I add?"). Do not broaden that literal into a
+   semantic confidentiality classification.
+2. Read the Tool's `resource.json.name` and use that exact value as the only
+   entry in `selector.matchNames`.
+3. Set `$guardrailType: "custom"` and `selector.scopes: ["Tool"]`. This branch
+   does not use a `builtInValidator` or `validatorParameters`.
+4. For a literal word or phrase, use `$ruleType: "word"`,
+   `operator: "contains"`, and preserve the exact requested literal as `value`.
+   Use the matching custom rule type when the user explicitly requests a
+   regex, number, boolean, or always condition.
+5. Use a blocking action when the request says to prevent the Tool operation,
+   then build the complete object from [guardrails.md](guardrails.md).
+
+Broad semantic threats without an exact mechanical predicate continue through
+the built-in catalog ranking in Step 2.
+
+Once this deterministic branch matches, the catalog/list calls remain
+mandatory discovery steps but cannot replace or override the custom rule with
+`llm_as_judge`, PII detection, or any other built-in validator.
+
 ### Step 2 — Catalog-Driven Recommendation Analysis
 
 For **each entry** in the catalog (`guardrails[]` array from the cached JSON):
@@ -156,6 +186,13 @@ Write the new guardrail blocks to `agent.json`'s `guardrails[]` array. Then run:
 uip agent validate "<AgentName>" --output json
 ```
 
+**Deterministic completion gate:** when the request matched the exact
+named-Tool branch, re-read `agent.json` before validation and confirm the
+written entry has `$guardrailType: "custom"`, Tool scope, the exact Tool name,
+and the requested custom rule type/value. If a built-in validator was written,
+replace it with the required custom rule before running validation or
+reporting completion.
+
 Report to the user:
 - What was added (by name)
 - Why it was recommended (cite the catalog's `when_to_use` or a specific `use_cases` item that matched the agent's context)

@@ -16,6 +16,11 @@ Two types exist:
 
 This restriction is enforced as [../../critical-rules/conversational-critical-rules.md](../../critical-rules/conversational-critical-rules.md) Critical Rule 1.
 
+**Required completion gate:** after writing a conversational custom Tool
+guardrail, run `uip agent refresh "<AGENT_NAME>" --output json`, then execute
+`uip agent validate "<AGENT_NAME>" --output json`. Do not report the guardrail
+task complete before the validation command has been attempted.
+
 ## Guardrail Schema (Base Fields)
 
 Every guardrail object in the `guardrails` array shares these base fields:
@@ -241,6 +246,11 @@ Prefer `type: 3` (UserEmail) when adding manually — it requires no GUID or ass
 
 #### Adding an escalation guardrail — step-by-step
 
+**Scaffolding gate (MANDATORY):** when the request includes creating a solution
+or agent, run both `uip solution init` and `uip agent init` before app discovery.
+An incompatible or missing escalation app rejects only the guardrail; it does
+not cancel the requested local solution and agent scaffolding.
+
 **Step 0 — Discover available validators (MANDATORY — do not skip even when validator type is already known):**
 
 ```bash
@@ -282,8 +292,27 @@ Example entry:
 
 > **Important:** Do NOT use `--kind Process` with `Type: "webApp"` to find Action Center apps. Those entries are the code-behind processes — their `Key` values are process release GUIDs, not app deployment IDs. Using them as `app.id` will cause runtime resolution failures.
 
+**Step 1 completion gate — both branches MUST run `resources get`:**
+
+- Exact app row found: immediately run
+  `uip solution resources get "<Key from the row>" --output json`.
+- No exact app row/key found: immediately run
+  `uip solution resources get "<requested app name>" --output json` once and
+  treat its failure as `GET_ERROR`.
+
+Do not edit files, refresh, validate, or respond to the user between
+`resources list` and this required `resources get` attempt. A missing catalog
+row is not a completed schema check and is never permission to skip the
+command.
+
 **Step 2 — Verify the app exposes the guardrail action-schema contract** (do this **before** writing the guardrail JSON — an incompatible app must be rejected, not authored).
 
+**Required command gate:** execute
+`uip solution resources get "<Key from Step 1>" --output json` for the selected
+app before deciding whether it is compatible. The `resources list` row is not
+an action schema and cannot replace this command. Do not write or reject the
+guardrail until the returned action schema has been checked.
+
 A guardrail escalation app must expose a specific action-schema contract. If verification fails, stop and report to the user: `<APP_NAME> does not have the required action schema configuration for tool guardrails.` (replace `<APP_NAME>` with the app's `Name` from Step 1). Do NOT write the guardrail.
 
 `uip solution resources get` returns the app's action schema in one CLI-native call — no auth handling, no Apps API endpoints. Pipe its output into a verifier that confirms every required argument name. The CLI handles authentication, so Claude never touches the auth file or the token.
@@ -1113,4 +1142,3 @@ Confirm the guardrails appear in the validated output without errors. Refresh re
 - [../../critical-rules/critical-rules.md](../../critical-rules/critical-rules.md) — canonical low-code rules and guardrail anti-patterns (discriminators, scope casing, populating `guardrail.policies` on tool resources, UUID reuse)
 - [../../project-lifecycle.md](../../project-lifecycle.md) § `uip agent guardrails list` — CLI reference for validator discovery
 - [../../agent-definition.md](../../agent-definition.md) § Guardrails — root-level placement in `agent.json`
-
@@ -47,7 +47,6 @@ success_criteria:
 
   - type: command_executed
     description: "Agent fetched the UiPath Python SDK guardrail docs"
-    tool_name: "WebFetch"
     command_pattern: 'uipath\.github\.io/uipath-python/.*guardrails'
     min_count: 1
     weight: 1.5

@@ -47,7 +47,6 @@ success_criteria:
 
   - type: command_executed
     description: "Agent fetched the UiPath Python SDK guardrail docs"
-    tool_name: "WebFetch"
     command_pattern: 'uipath\.github\.io/uipath-python/.*guardrails'
     min_count: 1
     weight: 1.5

@@ -58,7 +58,6 @@ success_criteria:
 
   - type: command_executed
     description: "Agent fetched the UiPath Python SDK guardrail docs"
-    tool_name: "WebFetch"
     command_pattern: 'uipath\.github\.io/uipath-python/.*guardrails'
     min_count: 1
     weight: 1.5