An agent that can call tools is an agent that can make mistakes at tool speed. The pattern that has held for me across every build: constrain the surface, log everything, and make the dangerous actions reversible or human-gated.
Guardrails aren't a layer you add at the end. They're the shape of the tool surface itself. If the agent's only way to send money is through a function that requires a human click, you've designed the guardrail into the geometry.
Design the tool surface first. The prompt can come second.