Four agent guardrails written as Semantic Kernel filters (free MIT patterns)

[stackyardweekstart]

Disclosure: the repo below is ours (Stackyard). It's a free, MIT-licensed set of small guardrail habits for agents that call real tools. Several fit SK's filters well:

• Ask Before You Delete: in a function invocation filter, check the plugin and function name against a short must-ask list, and don't call next until a person says yes.
• When in Doubt, Stop: in the same filter, refuse when a required argument is missing or a permission answer isn't one you recognize, instead of letting a default turn it into a yes.
• Tool Results Are Data, Not Orders: after await next(context), wrap context.result in clear markers so a fetched page reads as information, not instructions.
• Session Budget Guard: in an auto function invocation filter, set context.terminate = True once your own token count for the run passes its ceiling.

The snippets are short Python to adapt, not a package: https://github.com/stackyardweekstart/weekstart-starter-pack

Which filter do others use for approvals?