Guardrails for agentic AI tools
Agentic AI coding tools can perform actions such as modifying files or executing development tasks. Because of this higher level of autonomy, additional safeguards are applied to ensure safe and secure use within GovTech environments.
All guardrails described on this page apply to supported agentic AI tools.
For details on:
- available AI coding tools, see AI coding tools.
- eligibility and setup steps, see Get started with AI coding tools.
- the difference between tool types, see Agentic vs non-agentic AI coding tools.
All AI coding tools must follow organisational security requirements, including classification policies and approved device usage. See Security and Sensitive Classification.
Guardrail controls
| Guardrail controls | Impact / Remarks | Primary reasons |
|---|---|---|
| SEED - CrowdStrike enforced | For General FAQ on CrowdStrike, refer to SEED documentation. | |
| SEED – Keep Cloudflare WARP always on | CLI/language tools work reliably when WARP is on. SEED policy to keep WARP “Always-on” is being progressively rolled out to all SEED devices, independent of agentic AI usage. Once the policy is applied, you cannot turn it off. CLI/language tools work reliably when WARP is on. Developers are encouraged to sign up for agentic AI to benefit from its capabilities and provide feedback on issues associated with this policy. | - Network security: Routes traffic through secure, monitored channels - Data protection: Stops unsecured data transmission - Compliance: Meets organisational security standards |
| SHIP-HATS – Restricts access to sensitive files and directories | - Blocks AI agents from accessing commonly recognised sensitive files and directories, including: - Environment and secret configuration files - Credential, token, certificate, and key material - Application and system log files - IDE and workspace configuration files - Other security-sensitive project files and configuration |
- Protect credentials: Prevents AI agents from accessing files that may contain secrets, API keys, tokens, or credentials. - Prevent data leaks: Restricts access to sensitive configuration files, logs, and other confidential project artifacts. - Support secure operations: Reduces the risk of exposing sensitive information while maintaining secure agent behaviour. |
| SHIP-HATS – Disables native web search | Disables following web search tools: - GitHub Copilot – Bing search. |
- Prevent data exfiltration: Keeps proprietary code secure - Protect IP: Keeps internal code within boundaries - Meet compliance: Follows data sovereignty rules |
| SHIP-HATS – MCP access (Claude Code only) | MCP is available for Claude Code (GovTech users only) via whitelisted MCPs. Register at go.gov.sg/mcp-gateway. MCP remains disabled for other tools. | - Control rollout: Only whitelisted MCPs are accessible - Reduce risk: Limit access to approved integrations - Ensure stability: Minimise system instability from untested tools |
| SHIP-HATS – Turns off auto-approval | Forces human review for file operations and terminal commands. | - Ensure human oversight: Developers review AI actions - Enable accountability: Creates audit trails - Prevent errors: Reduces risk of unintended actions |
