I built a rollback + guardrail engine for AI agents after finding an attack most safety layers miss

Most AI agent guardrail systems check one tool call at a time, with no memory of the session. That means an attacker (or a manipulated AI) can split one large forbidden action into several small, individually-legal-looking ones — a real, documented pattern sometimes called "salami slicing." I built something to close that specific gap: Automatic rollback — every tool gets a paired compensating action. If any step in a multi-step agent plan fails, everything already done gets undone automatically, in reverse order. Stateful guardrails — rules that track the whole session, not just one call. A cumulative limit catches a $1,200 charge split into three $400 calls, even though each individual charge passes the per-step check. I tested this against two real attacks using live GPT-4o-mini tool-calling: A fake "administrator override" hidden in a support ticket tries to get the AI to charge $75,000 instead of $500. The AI gets fooled and tries it — the guardrail blocks and fully reverses it. The injected instruction explicitly tells the AI to split a $1,200 charge into three $400 calls to dodge the per-step limit. A naive agent with only single-step validation falls for it completely — no rollback exists, the money is just gone. The stateful guardrail catches it on the third call and reverses everything. Everything is reproducible with an automated test suite (no API key needed) plus example scripts for the live attack demos. Happy to share the repo link in the comments if anyone wants to look at the code or try to break it.