fix: guardrail fixes

frontend/src/agents/NewAgent.tsx

@@ -1471,7 +1471,16 @@ export default function NewAgent({ mode }: { mode: 'new' | 'edit' | 'draft' }) {
           <GuardrailsSection
             value={agent.config?.guardrails}
             token={token}
-            disabled={agent.team_access === 'viewer'}
+            // Guardrails are the owner's policy: the update route drops
+            // ``config`` for team members, editors included. Leaving the
+            // controls live for editors let them save a change the server
+            // silently discarded, and the success toast said it had worked.
+            disabled={Boolean(agent.team_access)}
+            disabledNotice={
+              agent.team_access
+                ? t('agents.form.guardrails.ownerOnly')
+                : undefined
+            }
             onChange={(guardrails) =>
               setAgent({
                 ...agent,

frontend/src/agents/components/GuardrailsSection.tsx

@@ -88,6 +88,8 @@ type Props = {
   onChange: (next: GuardrailsConfig) => void;
   token: string | null;
   disabled?: boolean;
+  /** Why the controls are read-only, shown in place of a silent lockout. */
+  disabledNotice?: string;
 };
 
 export default function GuardrailsSection({
@@ -95,6 +97,7 @@ export default function GuardrailsSection({
   onChange,
   token,
   disabled = false,
+  disabledNotice,
 }: Props) {
   const { t } = useTranslation();
   const [expanded, setExpanded] = React.useState(false);
@@ -255,6 +258,15 @@ export default function GuardrailsSection({
             <p className="text-destructive mt-3 text-xs">{loadError}</p>
           )}
 
+          {disabled && disabledNotice && (
+            <p
+              className="mt-3 rounded-lg bg-gray-100 px-3 py-2 text-xs text-gray-700 dark:bg-gray-800 dark:text-gray-300"
+              data-testid="guardrails-read-only"
+            >
+              {disabledNotice}
+            </p>
+          )}
+
           {instanceDisabled && (
             <p
               className="mt-3 rounded-lg bg-amber-50 px-3 py-2 text-xs text-amber-800 dark:bg-amber-900/30 dark:text-amber-300"

frontend/src/locale/de.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/en.json

@@ -1293,7 +1293,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1305,7 +1304,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1319,6 +1318,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/es.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/jp.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/ru.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/zh-TW.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",

frontend/src/locale/zh.json

@@ -1292,7 +1292,6 @@
         "mode": "Enforcement mode",
         "monitorHint": "Monitor mode records what would have happened without changing any answer. Start here, review the log, then switch to enforcing.",
         "checks": "Checks",
-        "activeSuffix": "active",
         "latencyHint": "Approximate added latency when this check runs",
         "notConfigured": "Not configured",
         "lockedByFloor": "Required by the instance policy and cannot be removed",
@@ -1304,7 +1303,7 @@
         "timeout": "Check timeout (ms)",
         "loadError": "Could not load the guardrail catalog",
         "terms": "Banned terms (one per line)",
-        "termsPlaceholder": "competitor name\\ninternal codename",
+        "termsPlaceholder": "competitor name\ninternal codename",
         "allowHosts": "Allowed hosts (one per line)",
         "blockHosts": "Blocked hosts (one per line)",
         "policyText": "Policy",
@@ -1318,6 +1317,7 @@
         "pickAtLeastOne": "Pick at least one — the check cannot run with none selected.",
         "remove": "Remove",
         "instanceDisabled": "Guardrails are switched off for this instance, so nothing configured here will run. Ask your administrator to set GUARDRAILS_ENABLED.",
+        "ownerOnly": "Guardrails are set by the agent's owner. You can see this policy but only the owner can change it.",
         "floorNotice": "{{count}} control(s) are required by this instance and always apply.",
         "floorControl": "{{stage}}: {{action}} — required by the instance policy",
         "unknownCheck": "This agent uses a check that is not available here ({{check}}). It will still run if the check returns.",