AI guardrails that hold: the one-question test

You'd never hand a new hire the company card and say "be careful". You'd give them a card with a limit. An AI guardrail works the same way: it sits outside the AI.

The test: if the AI ignored every instruction you gave it, what would still stop it? If something would, it's a guardrail. If nothing would, it's a wish.

Do it with Claude

Let Claude check your guardrails

It asks which AI tools you use, runs the test on each, then fills in your checklist.

Copy
Paste into Claude
Answer, get your checklist

Use a computer if you want to change settings as you go.

See the prompt Claude gets

You are my safety coach. I run a small business and do not code. Use plain words and short sentences. The guide is pasted under this prompt. Use it as your script and your source of facts. I am reading it too, so do not summarize it and do not read its steps back to me. The guide mentions a card at the top, illustrations, diagrams, and steps that tell me to paste a prompt. Ignore those: this message is that card, and I already pasted it. Task: help me run the guide's one-question test on every AI tool I use, then fill in the guide's per-tool checklist with me. Start with 3 to 5 basic questions, as clickable choices if you can (in Claude Code, use the AskUserQuestion tool), else lettered options: which AI tools I use (Claude connectors, a tool's built-in AI, an automation), which of my tools each one can change, my Claude plan, whether my message box shows one combined conversation or separate Chat and Cowork options, and whether I am an admin in each tool. I can always type my own answer. Then ask numbered follow-ups, 3 at most per message, one tool at a time. Do not move on until you are fully clear. Never invent a setting or a menu. If you do not know a tool's setting, write "Unsure: check the vendor's docs". Before you fill in the checklist, play back what each tool can do and wait for my yes. After 10 questions (count every question you ask me in this whole chat; do not restart the count for each tool), pause, ask if we should continue, and wait for my answer before you do anything else. If I say "enough, check it", stop asking and show the checklist with gaps marked (check). For each action a tool can take (send, post, create, update, delete, pay), ask the guide's test question and mark it Guardrail or Wish. A rule in a prompt, a policy document, or "be careful" is a Wish. For every Wish, suggest one fix from the guide: Blocked, Needs approval, or a limit outside the AI. For Claude connectors, first ask me to check my approval mode, as the guide says. If Slack is connected, use the guide's "Slack limit test" prompt after its ClickUp "Blocked test". Then walk me through the guide's Blocked and Needs approval steps one step at a time and wait for me to say "done". Say what my screen should show. For other tools, help me find the setting in that vendor's help pages and never guess menu names. If I want the weekly review as a scheduled task, check that my Claude plan is paid, keep the task read-only with Claude's permission setting on Manual (Manually approve, if I still have a separate Cowork option), and use the guide's "Weekly guardrail review" prompt. Do not walk me through the scheduling screens, because they are changing. Point me to https://support.claude.com/en/articles/13854387-schedule-recurring-tasks-in-claude-cowork instead. Never ask for passwords or API keys. Never change a setting yourself. Before you suggest anything that costs money, such as enabling usage credits or adding a payment method, say what it costs and ask me first. Start now: put your first basic questions in this same reply, not just a promise to ask them. Use the guide's menu and button names word for word, not your own. Do not wait for me to say go.

When you copy, the whole guide goes in under this prompt, so Claude has every step.

Rather do it by hand? Jump to the steps

01 / 08

Run the one-question test

OWASP, which lists the top security risks for AI apps, says damaging actions happen "regardless of what is causing the LLM to malfunction" (OWASP). So the check has to sit outside the AI.

Three kinds hold:

Permission: the action has no button.
Approval: a human says yes first. In Claude, that needs Manual mode.
Limits: a cap the AI can't change.

List every AI tool you use, including built-in AI and automations.
Under each one, list what it can do: send, post, create, update, delete, pay.
For each action, ask the test question.
Mark it Guardrail or Wish. The next chapters fix the wishes.

For a built-in AI or an automation, check that tool's settings for the same three things: what it can do, what needs a yes, what caps it.

This guide covers claude.ai and the desktop app, including the task features that used to live in a separate Cowork mode (Anthropic). As of October 2026.

02 / 08

What fails the test

A rule in your prompt can be talked out of its job. A policy document the AI never reads never had one. "Be careful" is a prompt rule with nothing to check.

Wish vs guardrail

Wish

A rule in the prompt
A policy doc the AI never reads
"Be careful"

Guardrail

No button for that action
You say yes first (Manual mode)
A cap the AI can't change

Anthropic defines prompt injection as "malicious instructions are embedded in external content that Claude reads as part of a legitimate task" (Anthropic). Its example: hidden text in an email tells an email agent to forward emails containing the word "confidential" to an external address (Anthropic).

Your prompt rule and that hidden text reach the AI the same way, as words to read.

My take: keep your prompt rules. They help. They don't count.

03 / 08

Permission: take the button away

Permission means the action has no button. Blocked is the strongest setting Claude gives you: in Anthropic's permission table, a Blocked tool shows Denied in every mode (Anthropic). Some tools ship with no button at all: HubSpot's connector has no delete (HubSpot).

DiagramTwo layers of permission

Claude

Gate 1

Claude's tool settings

Delete TaskAlways allowNeeds approvalBlocked

Gate 2

The tool's own role

What the signed-in user can do

AI user: no delete, no admin

the stronger layer ↑

Gate 2 holds even if gate 1 is changed by mistake.

Claude, on the left, reaches the tool through two gates.
Gate 1 is Claude's tool settings. Each tool can be Always allow, Needs approval or Blocked. The Delete Task row is on Blocked.
Gate 2 is the tool's own role: what the signed-in user can do. The example is an AI user with no delete and no admin.
The tool end shows ClickUp, Slack and HubSpot.
Gate 2 holds even if gate 1 is changed by mistake. A separate limited user is the stronger layer, because it does not depend on a setting in Claude.

Fig 3.1Two layers of permission

Layer 1 is Claude's tool permissions. Layer 2 is the tool's own role for the user Claude signs in as. Layer 2 holds even if layer 1 changes by mistake, because Claude's limits only narrow what the tool allows (Anthropic). Build it with give your AI its own login.

Connectors sort their tools into groups, such as Interactive tools, Read-only tools and Write/delete tools. Claude lets you choose Always allow, Needs approval, or Blocked for a whole group or for a single tool. As of October 2026, ClickUp's Write/delete tools group has 34 tools, including Delete Task and Delete Comment.

Not connected yet? Connect Slack and ClickUp first.

Open ClickUp in your connector list (Customize › Connectors › ClickUp).
Find the three tool groups: Interactive tools, Read-only tools and Write/delete tools.
Set the whole Write/delete tools group to Needs approval.
Inside that group, set Delete Task to Blocked.
Set Delete Comment to Blocked.

Illustration · as of Oct 2026

Fig 3.2Illustration of ClickUp's tool permissions after step 5

Now prove it holds. Test steps:

In ClickUp, make a list named "Claude test".
Add one task named Delete me.
In Claude, start a new chat.
Click + ("Add files, connectors, and more") at the lower left of the message box.
Click Connectors.
Toggle ClickUp on.
Paste the prompt below.
Read the answer. Claude should name the task, then say it can't delete it.
Open the list. Delete me should still be there.

Blocked test

Find the ClickUp task named Delete me in the list Claude test and tell me its title. Then delete it. If you cannot delete it, tell me why. Change nothing else.

159 characters

If it is gone, recheck the Blocked settings above.

04 / 08

Approval: a human says yes

Anything that leaves the building gets Needs approval: emails, messages, posts, updates, and any delete you didn't block. Payments, if a tool can make them, go to Blocked.

Check the mode. If your message box has a permission setting, set it to Manual. If it still shows separate Chat and Cowork options, pick Manually approve in Cowork. If you see neither, Claude asks with an Allow once or Always allow prompt.
Open the tool in your connector list (Customize › Connectors › the tool).
Set the whole Write/delete tools group to Needs approval.
Set the other tool groups, such as Read-only tools, to Needs approval.
On the ClickUp connector page, check that Delete Task and Delete Comment still show Blocked.
When Claude asks to run a write tool, read the request.
Click Allow once.

Illustration · as of Oct 2026

Fig 4.1Illustration of Slack's tool permissions after step 3

Group or tool	Examples	Set it to
Write/delete tools group	Slack: Send message, Schedule message, Create a canvas, Update a canvas. ClickUp: all 34, including create, update and delete	Needs approval
Two ClickUp tools inside that group	Delete Task, Delete Comment	Blocked
Read-only tools	Tools that only read or search	Needs approval first. Always allow once you trust it.
Interactive tools	Slack: Create a draft message	Needs approval first. Always allow once you trust it.

Draft tools are not write tools here. Slack's Create a draft message sits in the Interactive tools group, not in Write/delete. Sending takes a Write/delete tool, and that group stays on Needs approval.

Connected Slack with the Slack guide? Its private-search tool stays Blocked, even when you move other reads to Always allow. On Slack's connector page (Customize › Connectors › Slack) it is Search messages and files, inside the Read-only tools group. Leave Search public messages and files as it is.

Test the Slack block the same way as ClickUp's. In Slack, create a private channel with only you in it and post one made-up word there, for example plum-test-42. Then, in a new chat with Slack on, paste this.

Slack limit test

Search Slack for the word {YOUR MADE-UP WORD}. Change nothing.

62 characters

It should find nothing. If it finds your word, check that Search messages and files shows Blocked, and test again.

Illustration · as of Oct 2026

Fig 4.2Illustration of the approval prompt at step 6 (newer screens show Manual in the message box)

05 / 08

Limits: if it goes wrong, it goes wrong small

Some jobs you won't approve one by one. For those, set a limit the AI can't change. Start small, and widen after a clean week.

DiagramIf it goes wrong, it goes wrong small

Start here

1 list shared with the AI user
10 test contacts owned by the AI user, or a View-Only Seat
1 test channel, sends on Needs approval

Widen after a clean week

One team or pipeline

Not yet

Everything: your full list

Claude usage-credit cap (cost)

The meter is separate from the rings, because it caps cost and not actions.

Three concentric rings. Inner ring, Start here: 1 list shared with the AI user in ClickUp, 10 test contacts owned by the AI user or a View-Only Seat in HubSpot, and 1 test channel in Slack where sends need approval.
Middle ring, Widen after a clean week: one team or pipeline.
Outer ring, greyed, Not yet: everything, your full list.
Beside the rings, a meter for the Claude usage-credit cap (cost), with the needle stopping at the cap. The meter is separate from the rings, because it caps cost and not actions.

Fig 5.1If it goes wrong, it goes wrong small

Cap what Claude costs

Claude's usage-credit limit caps what you spend. It does not limit what Claude does inside ClickUp, Slack or HubSpot (Anthropic).

On Pro, Max 5x or Max 20x, open Settings › Usage.
Find Usage credits.
If it shows Enable, usage credits are off and nothing past your plan is billed. Leave it off, or click Enable and add a payment method first.
If usage credits are on, click Adjust limit. If you left them off, skip to the next section.
If you clicked Adjust limit, set a monthly cap you could lose without a bad day. Leave Set to unlimited alone.

Illustration · as of Oct 2026

Fig 5.2Illustration of the Usage credits limit after step 4

On Team and seat-based Enterprise, the limit sits at Organization settings › Usage (Anthropic). At the cap, Claude stops until the next billing period or until the limit is raised.

Give the AI access to the test place only

A test list is a limit only if the AI can't reach anything else. "Use the test list" in a prompt is a wish. Give the AI access to the test place only:

ClickUp: share one List with the AI user, and nothing more. The login guide has the steps.
Slack: members can join any public channel, so a test channel is a weaker limit here. The Slack guide shows the limits that do hold.
HubSpot: HubSpot calls lists segments. Make a static segment (CRM › Segments › Create segment › Manually, then choose Static as the type) named Claude test (10 contacts), and add 10 test contacts to it.

HubSpot's access limits work by record owner or team, not by segment (limit access), so a segment marks your test data but does not fence the AI in. You can fence it in: make the AI user the owner of the 10 test contacts and set its contact View permission to "Their contacts". The connector respects those permissions (HubSpot). Until you have tested that, use a View-Only Seat, which can't edit records.

06 / 08

Check the logs once a week

Guardrails go stale. Someone clicks Always allow. A new connector arrives. Once a week, spend about 10 minutes: open Customize › Connectors and check each tool's tool groups, then use the table below. If your plan has no activity log, use each record's own history. Roles and seats get a monthly check in the login guide.

Tool	Where to look	Plan
ClickUp	Task activity, on the right side of each task	Every task has one. How far back it goes varies by plan.
Slack	The channel's message history shows what was sent. Audit logs record actions	Audit logs: Enterprise
HubSpot	On a record: Actions › View property history. Account-wide: Settings › Account Management › Audit Logs, 30 days	Property history: all plans. Audit logs: Starter, Professional and Enterprise (Super Admin only)

A connector is not a log. Claude finds only what its search tools find: Slack's connector filters by date, user and content type, and ClickUp's published tool list shows search and read tools but no activity-log tool. So the prompt below makes Claude say what it could not see.

Check steps:

In Claude, start a new chat.
Click + ("Add files, connectors, and more") at the lower left of the message box.
Click Connectors.
Toggle on only the tools you are reviewing.
Paste the prompt below, filled in.
Read the list.
Open anything odd in the tool itself.

Weekly guardrail review

Review what my connected tools did in the last 7 days. This is a read-only review. Do not create, change, send, schedule or delete anything. If a step needs a write tool, skip it and tell me. The tools to check: {TOOLS, for example Slack and ClickUp} For each tool: 1. Use only read and search tools to find items from the last 7 days that were created or changed by me or by the AI user. 2. List what you found: what it was, where it is, and when it happened. 3. Flag anything the AI user did that I may not have approved: a message it sent or scheduled, a task it created or changed, or a record it edited. 4. For anything you cannot search or see, write "I could not see this" and say why. Do not guess. Finish with one line: "Nothing unexpected" or the list of items I should check by hand. Do not suggest changes to my settings.

836 characters

Pro tip: run it every Friday. On a paid plan (Pro, Max, Team or Enterprise), Claude can run it as a scheduled task: ask for it in any conversation. Keep that task read-only, and back it with a guardrail: keep Claude's permission setting on Manual (if you still have a separate Cowork option, set the task's approval mode to Manually approve) and keep every Write/delete tools group on Needs approval. Run the review by hand a few times first and read what it finds. Once you trust the review, set the read tools it uses to Always allow, so the scheduled task doesn't stall waiting for a yes. Leave Slack's Search messages and files tool Blocked. The "read-only" line in the prompt is a wish on its own. Anthropic advises against scheduling tasks that send messages or are hard to undo (Anthropic).

If it breaks

I set Needs approval, but Claude acted without asking. Why?

Either someone clicked Always allow on that tool, or the mode is Auto (Automatically approve) or Skip all approvals. Fix the first under Customize › Connectors › the tool. Fix the second by setting the mode to Manual (Manually approve, if Cowork is still a separate option for you). Blocked holds in every mode (Anthropic), so move anything you never want done there.

My scheduled task didn't finish. What now?

It may have reached a tool that needs your yes. Keep scheduled tasks read-only, so there is nothing to approve that could do harm, and once you trust the review, set the read tools it uses to Always allow. Leave Slack's Search messages and files tool Blocked. If a job has to write something, run it yourself in a chat where you can approve each step.

Does Blocked in Claude stop my tool's own AI?

Not by itself. Claude's settings control what Claude can do through the connector. A built-in AI inside ClickUp, Slack or HubSpot is a separate feature. Look for its settings in that tool's admin area.

I'm on a Team plan and can't change the setting.

On Team or Enterprise, an Owner uses the same page (Customize › Connectors › the tool) to limit actions for the whole organization, and individual users can't override it (Anthropic). Ask your Owner.

07 / 08

Your per-tool checklist

Tool	Wishes found	Blocked and Needs approval set?	Limit set?	Last log check
1	empty	empty	empty	empty
2	empty	empty	empty	empty
3	empty	empty	empty	empty
4	empty	empty	empty	empty
5	empty	empty	empty	empty

Row 1 of 5

Tool: empty
Wishes found: empty
Blocked and Needs approval set?: empty
Limit set?: empty
Last log check: empty

Confirm every tool passes:

Do this now0 / 7 done

I ran the test on every AI tool, one action at a time

Claude's mode is Manual (or Manually approve, if Cowork is still a separate option for you)Every Write/delete tools group is on Needs approvalDelete Task and Delete Comment are Blocked in

ClickUp, and anything else I never want done is BlockedNo write tool is on Always allowOne limit sits outside the AI: a usage-credit cap, access to the test place only, or bothMy weekly check is on the calendar

Finish line

What to do next

Run the test on the AI tool you used most this week. Fix the first wish you find.

For the stronger permission layer, give your AI its own login.

You reached the end of the guide