Guardian evaluates rule and behavioural risk signals on every action, then allows it, holds it for a human, or stops it — inside the authorization path.
An action can be inside every limit and still be wrong — a pattern break, a burst of activity, behaviour the mandate's author never imagined. A rulebook alone cannot say "this is technically permitted but should not happen."
Combine the signals — watch how the decision forms. Illustrative logic, local to this page.
The mandate decision, the agent's behavioural risk score (isolation-forest scoring with explainable factors, drift detection), and the human-approval state where the mandate requires one.
Allow — proceed. Hold — route to an operator with the factors that raised it. Stop — refuse, with the refusal recorded as evidence (RISK_SCORE_TOO_HIGH above the hard threshold).
Guardian is a soft dependency for scoring but the gate fails closed on rules: if the control layer cannot decide, the money action is refused.