# Guardrails

> Plain-English policies, protected areas, human review and an audit trail on every merge.

Guardrails gives you the speed of AI building with the controls a security team expects. It decides which changes can go straight through and which need a person to look first.

## What Guardrails does

- **Maps your code into business areas**, such as auth, billing or compliance.
- **Detects risky changes** that touch those areas.
- **Applies plain-English policies**, for example "changes to billing need approval from finance".
- **Records human review** when a change needs sign-off.
- **Keeps an audit trail** behind every merge.

## Protected Code Zones

Some areas are too important to change casually. Protected Code Zones lock them so the AI cannot modify them without the approval your policy requires.

## Writing a good policy

Keep each policy to one sentence about an area and an approver. Short, specific policies are easier to reason about than a long rulebook.

> [!note] Which governance features are available can depend on your plan. See [Pricing](https://automo.build/pricing).

Next: [Custom sandboxes](/build/custom-sandboxes).