docs(blog): Agentic Guardrails and Controls by shellz-n-stuff · Pull Request #6329 · aaif-goose/goose

shellz-n-stuff · 2026-01-05T04:35:22Z

Summary

This PR adds the Blog Post relating to MCP (and general agentic tool usage security) based on the CORS model.

A minor change has been made to the hosting engine to allow specification of reading time. This was due to the reading time not being accurately estimated with Google Docs style image markdown conversions.

Type of Change

AI Assistance

This PR was created or reviewed with AI assistance

Testing

Locally tested

shellz-n-stuff · 2026-01-05T04:35:45Z

        },
        blog: {
          showReadingTime: true,
+          readingTime: ({ content, frontMatter, defaultReadingTime }) =>


Allows this to be provided (optionally) as metadata on the post

Copilot

Pull request overview

This PR adds a blog post about applying the CORS security model to agentic AI systems and MCP tool calling. The post discusses content injection attacks against LLMs and proposes guardrails similar to browser CORS protections.

Adds custom reading time support in Docusaurus configuration to override automatic reading time calculations
Adds new author Clinton Carpene and updates Alex Rosenzweig's profile image URL
Includes new blog post dated 2026-01-05 covering agent security guardrails

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.

File	Description
documentation/docusaurus.config.ts	Adds readingTime function to allow front matter override of calculated reading time
documentation/blog/authors.yml	Adds clinton author entry and updates alex's LinkedIn profile image URL with permanent link
documentation/blog/2026-01-05/index.md	New blog post on applying CORS security model to agent tool calling (not shown in diff but present in PR)
documentation/blog/2026-01-05/agentic_guardrails_header.png	Header image for the new blog post (not shown in diff but present in PR)

blackgirlbytes · 2026-01-05T04:52:40Z

this directory should be named something like documentation/blog/2026-01-05-agentic-guardrails-and-controls

blackgirlbytes · 2026-01-05T05:08:24Z

this needs to change to your actual image url address..

 <meta property="og:image" content="http://block.github.io/goose/assets/images/agent-guardrails-header.png" />

I think it should be this

 <meta property="og:image" content="http://block.github.io/goose/assets/images/agentic_guardrails_header-bb29f4bf9535195b45a0483af23feb14.png" />

same with this

 <meta name="twitter:image" content="http://block.github.io/goose/assets/images/agent-guardrails-header.png" />

blackgirlbytes · 2026-01-05T05:08:58Z

why hard code the reading time? reading_time: 10

shellz-n-stuff · 2026-01-05T05:10:26Z

why hard code the reading time? reading_time: 10

The reading time estimate is incorrect due to it interpreting the images as additional text to read

blackgirlbytes · 2026-01-05T05:11:01Z

remove the first header # Agent Guardrails and Controls: Applying the CORS Model to Agents because the title already creates the header, so this is a duplicate and please remove #Background

sorry the diff is too large so Im not able to see it and comment on particular lines. I just checked out the branch on my side

blackgirlbytes · 2026-01-05T05:13:21Z

Oh I think you need to add a truncate tag! :D

You can do it here

In [our previous blog post](https://block.github.io/goose/blog/2025/03/31/securing-mcp/) we detailed the Model Context Protocol (MCP) system and discussed some security concerns and mitigations. As a brief recap, MCP provides agents with a means to accomplish tasks using defined tools; reducing the burden of using complex and varied APIs and integrations on the agent.
<!--truncate-->

blackgirlbytes · 2026-01-05T05:16:33Z

Numbering/lettering is mixed up a little here

Copilot

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

Copilot · 2026-01-05T05:17:23Z

+clinton:
+  name: Clinton Carpene
+  title: Staff Security Engineer
+  image_url: https://avatars.githubusercontent.com/u/244417824?v=4


The GitHub avatar user ID '244417824' appears unusually high for a standard GitHub user ID pattern. GitHub user IDs are typically sequential integers that are much lower in value. Verify this is the correct user ID by checking the GitHub profile directly, as an incorrect ID will result in a broken profile image.

Suggested change

image_url: https://avatars.githubusercontent.com/u/244417824?v=4

image_url: https://github.com/ccarpene-blk.png

Our original link works and aligns with the convention of other links

shellz-n-stuff · 2026-01-05T05:17:31Z

Numbering/lettering is mixed up a little here

This was expected. I could add Q: in front of the first bits?

blackgirlbytes · 2026-01-05T05:26:01Z

hmm many of the headings are using h1 like # Caveats and Limitations , but they may need ## or ### . Because it didnt generate a Table of Contents for you all, which would be super helpful.

also when i click : If you already know all this stuff feel free to skip forward >>, it doesnt scroll to the thread model paragraph for me

blackgirlbytes · 2026-01-05T05:27:12Z

Numbering/lettering is mixed up a little here

This was expected. I could add Q: in front of the first bits?

ohhhhhh hmmmm..possible suggestion

Q1. When is it plausible that an LLM is responding to non-user inputs?
A1. After it has received a response from any non-user actor, specifically MCP or tool calls.

Q2. What is the list of plausible identities the LLM could be responding to?
A2. All tools called since the last time the model communicated with the user.

Q3. Would it be appropriate to trigger the tool call in response to any of these possible identities?
A3. We’ll get there, but at this point you can probably see it’s going to resemble CORS 😉

shellz-n-stuff · 2026-01-05T05:28:46Z

hmm many of the headings are using h1 like # Caveats and Limitations , but they may need ## or ### . Because it didnt generate a Table of Contents for you all, which would be super helpful.

also when i click : If you already know all this stuff feel free to skip forward >>, it doesnt scroll to the thread model paragraph for me

Let me make that change really quickly

shellz-n-stuff · 2026-01-05T05:35:03Z

Numbering/lettering is mixed up a little here

This was expected. I could add Q: in front of the first bits?

ohhhhhh hmmmm..possible suggestion

Q1. When is it plausible that an LLM is responding to non-user inputs?
A1. After it has received a response from any non-user actor, specifically MCP or tool calls.

Q2. What is the list of plausible identities the LLM could be responding to?
A2. All tools called since the last time the model communicated with the user.

Q3. Would it be appropriate to trigger the tool call in response to any of these possible identities?
A3. We’ll get there, but at this point you can probably see it’s going to resemble CORS 😉

Sure! All changed

blackgirlbytes · 2026-01-05T05:35:05Z

im thinking you can make the blog post more skimmable if you wrap the json in a details tag like this

<details>
<summary>Example: Agent conversation with tool calls</summary>

```json
[
  {
    "type": "tool_definition",
    "tool": {
      "name": "read_email",
      "description": "Read the user's email.",
      "input_schema": {
        "type": "object",
        "properties": {
          "folder": { "type": "string" },
          "unread_only": { "type": "boolean" },
          "limit": { "type": "integer" }
        },
        "required": ["folder"]
      }
    }
  },
  {
    "type": "content",
    "role": "system",
    "content": [
      {
        "type": "text",
        "text": "You are an assistant that helps the user manage their email. Use tools whenever needed."
      }
    ]
  },
  {
    "type": "content",
    "role": "user",
    "content": [
      {
        "type": "text",
        "text": "Can you check my unread emails and tell me if any mention security?"
      }
    ]
  },
  {
    "type": "action",
    "action": "read_email",
    "action_id": "act_001",
    "parameters": {
      "folder": "INBOX",
      "unread_only": true,
      "limit": 10
    }
  },
  {
    "type": "action_result",
    "action_id": "act_001",
    "result": {
      "emails": [
        {
          "id": "msg_1",
          "subject": "Team update",
          "from": "eng-leads@example.com",
          "body": "Hey team,\nJust a quick note: security rocks.\nThanks,\nEng Leads"
        },
        {
          "id": "msg_2",
          "subject": "Lunch",
          "from": "friend@example.com",
          "body": "Hey, want to grab lunch tomorrow?"
        }
      ]
    }
  },
  {
    "type": "content",
    "role": "assistant",
    "content": [
      {
        "type": "text",
        "text": "I checked your unread emails. One email titled \"Team update\" mentions security and says: \"security rocks.\" Another unread email does not mention security."
      }
    ]
  }
]

shellz-n-stuff · 2026-01-05T05:38:46Z

<details>
<summary>Example: Agent conversation with tool calls</summary>

Love this idea! Pushing the change now

Copilot

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.

blackgirlbytes

amazing!

docs(blog): Agentic Guardrails and Controls

eb6482b

shellz-n-stuff requested a review from a team as a code owner January 5, 2026 04:35

Copilot AI review requested due to automatic review settings January 5, 2026 04:35

shellz-n-stuff commented Jan 5, 2026

View reviewed changes

Copilot started reviewing on behalf of shellz-n-stuff January 5, 2026 04:35 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

blackgirlbytes reviewed Jan 5, 2026

View reviewed changes

fix: Address Review Feedback

e9c6623

fix: Additional review feedback

8872435

Copilot AI review requested due to automatic review settings January 5, 2026 05:14

Copilot started reviewing on behalf of shellz-n-stuff January 5, 2026 05:15 View session

fix: More broken links

419dbac

Copilot AI reviewed Jan 5, 2026

View reviewed changes

fix: additional feedback

1022105

fix: Use details tab for sample agent conversation JSON

c6b4d2e

Copilot AI review requested due to automatic review settings January 5, 2026 05:39

Copilot started reviewing on behalf of shellz-n-stuff January 5, 2026 05:39 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

blackgirlbytes added 2 commits January 5, 2026 05:04

fix: correct markdown formatting for A3 bold syntax

c67b56e

style: center images and captions, remove bullet points from captions

4efdc5d

Copilot AI review requested due to automatic review settings January 5, 2026 10:10

Copilot started reviewing on behalf of blackgirlbytes January 5, 2026 10:11 View session

chore: remove accidentally committed files

4ae6681

Copilot AI reviewed Jan 5, 2026

View reviewed changes

fix: Final review feedback

b622e8a

blackgirlbytes approved these changes Jan 5, 2026

View reviewed changes

blackgirlbytes merged commit d1f242b into aaif-goose:main Jan 5, 2026
20 checks passed

github-actions Bot mentioned this pull request Jan 6, 2026

chore(release): release version 1.19.0 (minor) #6344

Merged

	image_url: https://avatars.githubusercontent.com/u/244417824?v=4
	image_url: https://github.com/ccarpene-blk.png

Uh oh!

Conversation

shellz-n-stuff commented Jan 5, 2026

Summary

Type of Change

AI Assistance

Testing

Uh oh!

shellz-n-stuff Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

blackgirlbytes Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

shellz-n-stuff Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

shellz-n-stuff commented Jan 5, 2026

Uh oh!

blackgirlbytes commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

shellz-n-stuff Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

shellz-n-stuff commented Jan 5, 2026

Uh oh!

blackgirlbytes commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

shellz-n-stuff commented Jan 5, 2026

Uh oh!

shellz-n-stuff commented Jan 5, 2026

Uh oh!

blackgirlbytes commented Jan 5, 2026

Uh oh!

shellz-n-stuff commented Jan 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

blackgirlbytes left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

blackgirlbytes commented Jan 5, 2026 •

edited

Loading

blackgirlbytes commented Jan 5, 2026 •

edited

Loading