diff --git a/.env.template b/.env.template
index 509fc97b..16e470f0 100644
--- a/.env.template
+++ b/.env.template
@@ -130,6 +130,10 @@
 # to streaming requests for OpenAI-compatible providers
 # ENFORCE_RETURNING_USAGE_DATA=true
 
+# Enable/disable guardrails globally (default: false)
+# When enabled, configured guardrails can run for workflows that reference them
+# GUARDRAILS_ENABLED=false
+
 # Guardrails for inline batch processing (default: false)
 # When true, guardrails are applied to inline /v1/batches request items
 # (e.g. /v1/chat/completions and /v1/responses items).
diff --git a/internal/admin/dashboard/dashboard_test.go b/internal/admin/dashboard/dashboard_test.go
index 158a16c2..c8ccfa0c 100644
--- a/internal/admin/dashboard/dashboard_test.go
+++ b/internal/admin/dashboard/dashboard_test.go
@@ -176,6 +176,29 @@ func TestStatic_ServesExecutionPlansModuleJS(t *testing.T) {
 	}
 }
 
+func TestStatic_ServesGuardrailsModuleJS(t *testing.T) {
+	h, err := New()
+	if err != nil {
+		t.Fatalf("New() returned error: %v", err)
+	}
+
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodGet, "/admin/static/js/modules/guardrails.js", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	if err := h.Static(c); err != nil {
+		t.Fatalf("Static() returned error: %v", err)
+	}
+
+	if rec.Code != http.StatusOK {
+		t.Errorf("expected 200, got %d", rec.Code)
+	}
+	if rec.Body.Len() == 0 {
+		t.Error("expected non-empty body for guardrails module JS file")
+	}
+}
+
 func TestStatic_ServesFavicon(t *testing.T) {
 	h, err := New()
 	if err != nil {
diff --git a/internal/admin/dashboard/static/css/dashboard.css b/internal/admin/dashboard/static/css/dashboard.css
index 8a5c0eb9..8185c9d3 100644
--- a/internal/admin/dashboard/static/css/dashboard.css
+++ b/internal/admin/dashboard/static/css/dashboard.css
@@ -792,6 +792,14 @@ body {
     color: var(--success);
 }
 
+.alert-inline-actions {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: 12px;
+    flex-wrap: wrap;
+}
+
 /* Table */
 .table-toolbar {
     display: flex;
@@ -2343,6 +2351,166 @@ body.conversation-drawer-open {
     width: 100%;
 }
 
+.page-subtitle {
+    margin-top: 6px;
+    color: var(--text-muted);
+    font-size: 14px;
+}
+
+.settings-subnav {
+    display: inline-flex;
+    gap: 8px;
+    padding: 6px;
+    margin-bottom: 20px;
+    border: 1px solid var(--border);
+    border-radius: 999px;
+    background: color-mix(in srgb, var(--bg-surface) 80%, transparent);
+}
+
+.settings-subnav-btn {
+    border: 0;
+    border-radius: 999px;
+    padding: 10px 14px;
+    background: transparent;
+    color: var(--text-muted);
+    font-size: 13px;
+    font-weight: 600;
+    cursor: pointer;
+    transition: background-color 0.18s ease, color 0.18s ease, transform 0.18s ease;
+}
+
+.settings-subnav-btn:hover {
+    color: var(--text);
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+}
+
+.settings-subnav-btn.active {
+    color: var(--text);
+    background: linear-gradient(135deg, color-mix(in srgb, var(--accent) 20%, transparent), color-mix(in srgb, var(--accent-hover) 16%, transparent));
+    box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--accent) 18%, var(--border));
+}
+
+.settings-guardrails-hero {
+    display: flex;
+    align-items: flex-start;
+    justify-content: space-between;
+    gap: 20px;
+    padding: 24px;
+    margin-bottom: 20px;
+    border: 1px solid color-mix(in srgb, var(--accent) 14%, var(--border));
+    border-radius: var(--radius);
+    background:
+        radial-gradient(circle at top right, color-mix(in srgb, var(--accent-hover) 18%, transparent), transparent 42%),
+        radial-gradient(circle at bottom left, color-mix(in srgb, var(--accent) 16%, transparent), transparent 40%),
+        var(--bg-surface);
+}
+
+.settings-kicker {
+    margin: 0 0 10px;
+    color: var(--accent);
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+}
+
+.settings-guardrails-hero h3 {
+    margin-bottom: 8px;
+}
+
+.settings-guardrails-hero p:last-child {
+    margin-bottom: 0;
+    color: var(--text-muted);
+}
+
+.settings-guardrails-meta {
+    display: flex;
+    gap: 12px;
+}
+
+.settings-guardrails-stat {
+    min-width: 110px;
+    padding: 14px 16px;
+    border: 1px solid color-mix(in srgb, var(--accent) 14%, var(--border));
+    border-radius: 16px;
+    background: color-mix(in srgb, var(--bg-surface-hover) 76%, transparent);
+}
+
+.settings-guardrails-stat-label {
+    display: block;
+    margin-bottom: 8px;
+    color: var(--text-muted);
+    font-size: 11px;
+    font-weight: 700;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+}
+
+.settings-guardrails-stat strong {
+    font-size: 24px;
+    font-weight: 700;
+}
+
+.settings-guardrails-layout {
+    display: grid;
+    grid-template-columns: 1fr;
+    gap: 20px;
+    align-items: start;
+}
+
+.settings-guardrails-layout.is-editor-open {
+    grid-template-columns: minmax(0, 1.35fr) minmax(320px, 0.9fr);
+}
+
+.settings-guardrails-list,
+.settings-guardrails-editor {
+    min-width: 0;
+}
+
+.settings-guardrail-type-pill {
+    display: inline-flex;
+    align-items: center;
+    padding: 6px 10px;
+    border: 1px solid color-mix(in srgb, var(--accent) 18%, var(--border));
+    border-radius: 999px;
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+    color: var(--text);
+    font-size: 12px;
+    font-weight: 600;
+    white-space: nowrap;
+}
+
+.settings-guardrail-summary {
+    color: var(--text);
+    font-size: 14px;
+    line-height: 1.45;
+}
+
+.settings-guardrail-description {
+    margin-top: 6px;
+    color: var(--text-muted);
+    font-size: 12px;
+}
+
+.settings-guardrail-textarea {
+    min-height: 150px;
+    width: 100%;
+    resize: vertical;
+    padding: 12px 14px;
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    background: var(--bg);
+    color: var(--text);
+    font: inherit;
+    line-height: 1.55;
+}
+
+.settings-guardrail-textarea:focus {
+    outline: none;
+    border-color: var(--accent);
+    box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent) 18%, transparent);
+}
+
 /* Responsive */
 @media (max-width: 768px) {
     .sidebar { width: 60px; flex-basis: 60px; }
@@ -2376,6 +2544,31 @@ body.conversation-drawer-open {
         gap: 8px;
     }
 
+    .settings-subnav {
+        display: flex;
+        width: 100%;
+    }
+
+    .settings-subnav-btn {
+        flex: 1 1 0;
+    }
+
+    .settings-guardrails-hero {
+        flex-direction: column;
+    }
+
+    .settings-guardrails-meta {
+        width: 100%;
+    }
+
+    .settings-guardrails-stat {
+        flex: 1 1 0;
+    }
+
+    .settings-guardrails-layout {
+        grid-template-columns: 1fr;
+    }
+
     /* Category tabs mobile */
     .category-tabs {
         gap: 4px;
@@ -2581,45 +2774,20 @@ body.conversation-drawer-open {
     display: flex;
     align-items: center;
     width: 100%;
-}
-
-/* Left/right halves — equal width keeps AI centered */
-.ep-left,
-.ep-right {
-    display: flex;
-    align-items: center;
-    flex: 1;
     min-width: 0;
 }
 
-.ep-right {
-    justify-content: flex-end;
-}
-
-/* Optional step wrapper (connector + node shown/hidden together) */
-.ep-step {
-    display: flex;
-    align-items: center;
-    flex-shrink: 0;
-}
-
 /* ─── Connectors ─── */
 
 .ep-conn {
-    flex-shrink: 0;
+    flex: 1 1 0;
+    min-width: 13px;
     position: relative;
-    width: 32px;
+    width: auto;
     height: 2px;
     background: color-mix(in srgb, var(--accent) 44%, var(--border));
 }
 
-/* Growing connector — fills remaining half to keep AI centered */
-.ep-conn-grow {
-    flex: 1;
-    min-width: 16px;
-    width: auto;
-}
-
 .ep-conn::after {
     content: "";
     position: absolute;
@@ -2658,8 +2826,8 @@ body.conversation-drawer-open {
     flex-direction: column;
     align-items: center;
     justify-content: center;
-    gap: 5px;
-    padding: 10px 14px;
+    gap: 4px;
+    padding: 8px 12px;
     border-radius: var(--radius);
     border: 1px solid var(--border);
     background: var(--bg-surface);
@@ -2759,154 +2927,90 @@ body.conversation-drawer-open {
     color: var(--text-muted);
 }
 
-.ep-node-endpoint-success {
-    border-color: color-mix(in srgb, var(--success) 52%, var(--border));
-    background: color-mix(in srgb, var(--success) 9%, var(--bg-surface));
-}
+/* ─── Shared node variants ─── */
 
-.ep-node-endpoint-success .ep-node-icon-endpoint {
-    color: var(--success);
-}
-
-.ep-node-endpoint-success .ep-node-label {
-    color: color-mix(in srgb, var(--success) 85%, var(--text));
-}
-
-/* ─── Guardrails node ─── */
-
-.ep-node-guardrails {
+.ep-node-feature {
     border-color: color-mix(in srgb, var(--accent) 46%, var(--border));
     background: color-mix(in srgb, var(--accent) 8%, var(--bg-surface));
 }
 
-.ep-node-guardrails .ep-node-icon {
+.ep-node-feature .ep-node-icon {
     background: color-mix(in srgb, var(--accent) 16%, var(--bg));
     color: var(--accent);
 }
 
-.ep-node-guardrails .ep-node-label {
+.ep-node-feature .ep-node-label {
     color: var(--accent);
 }
 
-.ep-node-guardrails .ep-node-sub {
+.ep-node-feature .ep-node-sub {
     color: color-mix(in srgb, var(--accent) 70%, var(--text-muted));
 }
 
-/* ─── Cache node ─── */
-
-.ep-node-cache {
-    border-color: color-mix(in srgb, var(--accent) 46%, var(--border));
-    background: color-mix(in srgb, var(--accent) 8%, var(--bg-surface));
-}
-
-.ep-node-cache .ep-node-icon {
-    background: color-mix(in srgb, var(--accent) 16%, var(--bg));
-    color: var(--accent);
-}
-
-.ep-node-cache .ep-node-label {
-    color: var(--accent);
-}
-
-/* Cache — runtime: exact hit */
-.ep-node-cache-hit {
+.ep-node-success {
     border-color: color-mix(in srgb, var(--success) 52%, var(--border));
     background: color-mix(in srgb, var(--success) 9%, var(--bg-surface));
 }
 
-.ep-node-cache-hit .ep-node-icon {
+.ep-node-success .ep-node-icon {
     background: color-mix(in srgb, var(--success) 18%, var(--bg));
     color: var(--success);
 }
 
-.ep-node-cache-hit .ep-node-label {
-    color: color-mix(in srgb, var(--success) 85%, var(--text));
-}
-
-.ep-node-cache-hit .ep-node-badge {
-    background: color-mix(in srgb, var(--success) 14%, var(--bg));
-    border-color: color-mix(in srgb, var(--success) 38%, var(--border));
+.ep-node-success .ep-node-icon-endpoint {
     color: var(--success);
 }
 
-/* Cache — runtime: semantic hit */
-.ep-node-cache-semantic {
-    border-color: color-mix(in srgb, var(--success) 52%, var(--border));
-    background: color-mix(in srgb, var(--success) 9%, var(--bg-surface));
-}
-
-.ep-node-cache-semantic .ep-node-icon {
-    background: color-mix(in srgb, var(--success) 18%, var(--bg));
-    color: var(--success);
+.ep-node-success .ep-node-label {
+    color: color-mix(in srgb, var(--success) 85%, var(--text));
 }
 
-.ep-node-cache-semantic .ep-node-label {
-    color: color-mix(in srgb, var(--success) 85%, var(--text));
+.ep-node-success .ep-node-sub {
+    color: color-mix(in srgb, var(--success) 74%, var(--text-muted));
 }
 
-.ep-node-cache-semantic .ep-node-badge {
+.ep-node-success .ep-node-badge {
     background: color-mix(in srgb, var(--success) 14%, var(--bg));
     border-color: color-mix(in srgb, var(--success) 38%, var(--border));
     color: var(--success);
 }
 
-/* Cache — runtime: miss badge only */
-.ep-node-cache-miss .ep-node-badge {
-    color: var(--text-muted);
-    border-color: var(--border);
-}
-
-/* ─── Auth node ─── */
-
-.ep-node-auth {
-    border-color: color-mix(in srgb, var(--accent) 46%, var(--border));
-    background: color-mix(in srgb, var(--accent) 8%, var(--bg-surface));
-}
-
-.ep-node-auth .ep-node-icon {
-    background: color-mix(in srgb, var(--accent) 16%, var(--bg));
-    color: var(--accent);
-}
-
-.ep-node-auth .ep-node-label {
-    color: var(--accent);
+.ep-node-error {
+    border-color: color-mix(in srgb, var(--danger) 52%, var(--border));
+    background: color-mix(in srgb, var(--danger) 9%, var(--bg-surface));
 }
 
-.ep-node-auth .ep-node-sub {
-    color: color-mix(in srgb, var(--accent) 70%, var(--text-muted));
+.ep-node-error .ep-node-icon {
+    background: color-mix(in srgb, var(--danger) 14%, var(--bg));
+    color: var(--danger);
 }
 
-.ep-node-auth-success {
-    border-color: color-mix(in srgb, var(--success) 52%, var(--border));
-    background: color-mix(in srgb, var(--success) 9%, var(--bg-surface));
+.ep-node-error .ep-node-icon-endpoint {
+    color: var(--danger);
 }
 
-.ep-node-auth-success .ep-node-icon {
-    background: color-mix(in srgb, var(--success) 18%, var(--bg));
-    color: var(--success);
+.ep-node-error .ep-node-label {
+    color: color-mix(in srgb, var(--danger) 85%, var(--text));
 }
 
-.ep-node-auth-success .ep-node-label {
-    color: color-mix(in srgb, var(--success) 85%, var(--text));
+.ep-node-error .ep-node-sub {
+    color: color-mix(in srgb, var(--danger) 72%, var(--text-muted));
 }
 
-.ep-node-auth-success .ep-node-sub {
-    color: color-mix(in srgb, var(--success) 70%, var(--text-muted));
+.ep-node-skipped {
+    position: relative;
+    opacity: 0.28;
 }
 
-.ep-node-auth-error {
-    border-color: color-mix(in srgb, var(--danger) 52%, var(--border));
-    background: color-mix(in srgb, var(--danger) 9%, var(--bg-surface));
-}
+/* ─── Cache node ─── */
 
-.ep-node-auth-error .ep-node-icon {
-    background: color-mix(in srgb, var(--danger) 14%, var(--bg));
-    color: var(--danger);
+/* Cache — runtime: miss badge only */
+.ep-node-cache-miss .ep-node-badge {
+    color: var(--text-muted);
+    border-color: var(--border);
 }
 
-.ep-node-auth-error .ep-node-label {
-    color: color-mix(in srgb, var(--danger) 85%, var(--text));
-}
+/* ─── Auth node ─── */
 
 /* ─── AI node ─── */
 
@@ -2917,25 +3021,6 @@ body.conversation-drawer-open {
     gap: 6px;
 }
 
-.ep-node-ai-success {
-    border-color: color-mix(in srgb, var(--success) 52%, var(--border));
-    background: color-mix(in srgb, var(--success) 9%, var(--bg-surface));
-}
-
-.ep-node-ai-success .ep-node-label {
-    color: color-mix(in srgb, var(--success) 85%, var(--text));
-}
-
-.ep-node-ai-success .ep-node-sub {
-    color: color-mix(in srgb, var(--success) 78%, var(--text-muted));
-}
-
-/* AI skipped — cache hit absorbed the request */
-.ep-node-ai-skipped {
-    position: relative;
-    opacity: 0.28;
-}
-
 /* ─── Async section ─── */
 
 /*
@@ -3008,6 +3093,7 @@ body.conversation-drawer-open {
 
 /* Dashed left-pointing connector between async nodes */
 .ep-conn-async {
+    flex: 0 0 24px;
     background: repeating-linear-gradient(
         to left,
         color-mix(in srgb, var(--text-muted) 45%, var(--border)) 0,
@@ -3016,7 +3102,6 @@ body.conversation-drawer-open {
         transparent 9px
     );
     width: 24px;
-    flex-shrink: 0;
 }
 
 /* Left-pointing arrowhead (overrides ep-conn::after right-pointing default) */
@@ -3053,32 +3138,12 @@ body.conversation-drawer-open {
     font-weight: 700;
 }
 
-.ep-node-async-audit {
-    border-color: color-mix(in srgb, var(--accent) 46%, var(--border));
-    background: color-mix(in srgb, var(--accent) 8%, var(--bg-surface));
-}
-
-.ep-node-async-audit .ep-node-icon {
-    background: color-mix(in srgb, var(--accent) 16%, var(--bg));
-    color: var(--accent);
-}
-
-.ep-node-async-audit .ep-node-label {
-    color: var(--accent);
-}
-
 .ep-node-async-usage {
-    border-color: color-mix(in srgb, var(--accent) 46%, var(--border));
-    background: color-mix(in srgb, var(--accent) 8%, var(--bg-surface));
-}
-
-.ep-node-async-usage .ep-node-icon {
-    background: color-mix(in srgb, var(--accent) 16%, var(--bg));
-    color: var(--accent);
+    --accent: var(--success);
 }
 
-.ep-node-async-usage .ep-node-label {
-    color: var(--accent);
+.ep-node-async-audit {
+    --accent: var(--warning);
 }
 
 /* "ASYNC" label inline on the right of the branch */
diff --git a/internal/admin/dashboard/static/js/dashboard.js b/internal/admin/dashboard/static/js/dashboard.js
index 43fa8714..35da1bd8 100644
--- a/internal/admin/dashboard/static/js/dashboard.js
+++ b/internal/admin/dashboard/static/js/dashboard.js
@@ -30,6 +30,7 @@ function dashboard() {
         apiKey: '',
         theme: 'system',
         sidebarCollapsed: false,
+        settingsSubpage: 'general',
 
         // Date picker
         datePickerOpen: false,
@@ -113,11 +114,47 @@ function dashboard() {
             if (page === 'audit') {
                 page = 'audit-logs';
             }
-            page = (['overview', 'usage', 'models', 'workflows', 'audit-logs', 'auth-keys', 'settings'].includes(page)) ? page : 'overview';
             const sub = parts[1] || null;
+            if (page === 'settings' && sub === 'guardrails') {
+                return { page: 'guardrails', sub: null };
+            }
+            page = (['overview', 'usage', 'models', 'workflows', 'audit-logs', 'guardrails', 'auth-keys', 'settings'].includes(page)) ? page : 'overview';
             return { page, sub };
         },
 
+        _normalizeSettingsSubpage(subpage) {
+            return 'general';
+        },
+
+        _settingsPath(subpage) {
+            return '/admin/dashboard/settings';
+        },
+
+        _applyRoute(page, sub) {
+            this.page = page;
+            this.settingsSubpage = page === 'settings'
+                ? this._normalizeSettingsSubpage(sub)
+                : 'general';
+
+            if (page === 'usage' && sub === 'costs') this.usageMode = 'costs';
+            if (page === 'usage' && sub !== 'costs') this.usageMode = 'tokens';
+            if (page === 'audit-logs') this.fetchAuditLog(true);
+            if (page === 'auth-keys' && typeof this.fetchAuthKeys === 'function') this.fetchAuthKeys();
+            if (page === 'workflows' && typeof this.fetchExecutionPlansPage === 'function') {
+                this.fetchExecutionPlansPage();
+            }
+            if (page === 'guardrails' && typeof this.fetchGuardrailsPage === 'function') {
+                this.fetchGuardrailsPage();
+            }
+            if (page === 'settings') {
+                if (typeof this.ensureTimezoneOptions === 'function') {
+                    this.ensureTimezoneOptions();
+                }
+            }
+            if (page === 'overview') this.renderChart();
+            if (page === 'usage') this.fetchUsagePage();
+        },
+
         init() {
             if (typeof this.initTimeZoneState === 'function') {
                 this.initTimeZoneState();
@@ -128,28 +165,11 @@ function dashboard() {
             this.applyTheme();
 
             const { page, sub } = this._parseRoute(window.location.pathname);
-            this.page = page;
-            if (page === 'usage' && sub === 'costs') this.usageMode = 'costs';
-            if (page === 'audit-logs') this.fetchAuditLog(true);
-            if (page === 'auth-keys' && typeof this.fetchAuthKeys === 'function') this.fetchAuthKeys();
-            if (page === 'settings' && typeof this.ensureTimezoneOptions === 'function') this.ensureTimezoneOptions();
+            this._applyRoute(page, sub);
 
             window.addEventListener('popstate', () => {
                 const { page: p, sub: s } = this._parseRoute(window.location.pathname);
-                this.page = p;
-                if (p === 'usage') {
-                    this.usageMode = s === 'costs' ? 'costs' : 'tokens';
-                    this.fetchUsagePage();
-                }
-                if (p === 'overview') this.renderChart();
-                if (p === 'audit-logs') this.fetchAuditLog(true);
-                if (p === 'auth-keys' && typeof this.fetchAuthKeys === 'function') this.fetchAuthKeys();
-                if (p === 'workflows' && typeof this.fetchExecutionPlansPage === 'function') {
-                    this.fetchExecutionPlansPage();
-                }
-                if (p === 'settings' && typeof this.ensureTimezoneOptions === 'function') {
-                    this.ensureTimezoneOptions();
-                }
+                this._applyRoute(p, s);
             });
 
             window.matchMedia('(prefers-color-scheme: dark)').addEventListener('change', () => {
@@ -168,15 +188,25 @@ function dashboard() {
         },
 
         navigate(page) {
-            this.page = page;
-            if (page === 'usage') this.usageMode = 'tokens';
+            if (page === 'settings') {
+                this.navigateSettings('general');
+                return;
+            }
+
             history.pushState(null, '', '/admin/dashboard/' + page);
-            if (page === 'overview') this.renderChart();
-            if (page === 'usage') this.fetchUsagePage();
-            if (page === 'workflows' && typeof this.fetchExecutionPlansPage === 'function') this.fetchExecutionPlansPage();
-            if (page === 'audit-logs') this.fetchAuditLog(true);
-            if (page === 'auth-keys' && typeof this.fetchAuthKeys === 'function') this.fetchAuthKeys();
-            if (page === 'settings' && typeof this.ensureTimezoneOptions === 'function') this.ensureTimezoneOptions();
+            this._applyRoute(page, null);
+        },
+
+        navigateSettings(subpage) {
+            const normalized = this._normalizeSettingsSubpage(subpage);
+            history.pushState(null, '', this._settingsPath(normalized));
+            this._applyRoute('settings', normalized);
+        },
+
+        guardrailsPageVisible() {
+            return typeof this.executionPlanRuntimeBooleanFlag === 'function'
+                ? this.executionPlanRuntimeBooleanFlag('GUARDRAILS_ENABLED', true)
+                : true;
         },
 
         setTheme(t) {
@@ -489,6 +519,10 @@ function dashboard() {
             typeof dashboardAuthKeysModule === 'function' ? dashboardAuthKeysModule : null,
             'dashboardAuthKeysModule'
         ),
+        resolveModuleFactory(
+            typeof dashboardGuardrailsModule === 'function' ? dashboardGuardrailsModule : null,
+            'dashboardGuardrailsModule'
+        ),
         resolveModuleFactory(
             typeof dashboardExecutionPlansModule === 'function' ? dashboardExecutionPlansModule : null,
             'dashboardExecutionPlansModule'
diff --git a/internal/admin/dashboard/static/js/modules/dashboard-layout.test.js b/internal/admin/dashboard/static/js/modules/dashboard-layout.test.js
index 7b3cfd67..1e5df291 100644
--- a/internal/admin/dashboard/static/js/modules/dashboard-layout.test.js
+++ b/internal/admin/dashboard/static/js/modules/dashboard-layout.test.js
@@ -29,6 +29,7 @@ test('sidebar and main content share the flex layout without manual content offs
 
     assert.match(template, /<aside class="sidebar"[\s\S]*<div class="sidebar-toggle"[\s\S]*<main class="content"/);
     assert.doesNotMatch(template, /content-collapsed/);
+    assert.match(template, /href="\/admin\/dashboard\/guardrails"[\s\S]*x-show="guardrailsPageVisible\(\)"[\s\S]*<span>Guardrails<\/span>[\s\S]*href="\/admin\/dashboard\/auth-keys"[\s\S]*<span>API Keys<\/span>/);
 
     const sidebarRule = readCSSRule(css, '.sidebar');
     assert.match(sidebarRule, /flex:\s*0 0 var\(--sidebar-width\)/);
@@ -72,7 +73,7 @@ test('dashboard layout pins Chart.js to 4.5.0', () => {
     );
     assert.match(
         template,
-        /<script src="\/admin\/static\/js\/modules\/conversation-helpers\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/clipboard\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/audit-list\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/auth-keys\.js"><\/script>/
+        /<script src="\/admin\/static\/js\/modules\/conversation-helpers\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/clipboard\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/audit-list\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/auth-keys\.js"><\/script>[\s\S]*<script src="\/admin\/static\/js\/modules\/guardrails\.js"><\/script>/
     );
 });
 
@@ -86,7 +87,8 @@ test('dashboard pages reuse a shared auth banner template', () => {
     );
 
     const authBannerCalls = indexTemplate.match(/{{template "auth-banner" \.}}/g) || [];
-    assert.equal(authBannerCalls.length, 6);
+    assert.equal(authBannerCalls.length, 7);
+    assert.match(indexTemplate, /<div x-show="page==='guardrails'">[\s\S]*{{template "auth-banner" \.}}/);
     assert.doesNotMatch(
         indexTemplate,
         /<div class="alert alert-warning" x-show="authError">[\s\S]*Authentication required\. Enter your API key in the sidebar to view data\.[\s\S]*<\/div>/
@@ -106,6 +108,15 @@ test('auth key expirations render as a UTC date with the full UTC timestamp in t
     assert.match(indexTemplate, /x-show="authKeys\.length === 0 && !authKeysLoading && !authError && !authKeyError && authKeysAvailable"/);
 });
 
+test('workflow guardrail warning links directly to the top-level guardrails page', () => {
+    const indexTemplate = readFixture('../../../templates/index.html');
+
+    assert.match(indexTemplate, /No named guardrails are currently registered on this deployment\./);
+    assert.match(indexTemplate, /class="alert alert-warning alert-inline-actions" x-show="guardrailRefs\.length === 0"/);
+    assert.match(indexTemplate, /@click="navigate\('guardrails'\)">Open Guardrails<\/button>/);
+    assert.match(indexTemplate, /id="guardrail-filter"[^>]*aria-label="Guardrail filter"[^>]*x-model="guardrailFilter"/);
+});
+
 test('usage and audit pages reuse a shared pagination template', () => {
     const indexTemplate = readFixture('../../../templates/index.html');
     const paginationTemplate = readFixture('../../../templates/pagination.html');
diff --git a/internal/admin/dashboard/static/js/modules/execution-plans-layout.test.js b/internal/admin/dashboard/static/js/modules/execution-plans-layout.test.js
index cfab5c51..eb798715 100644
--- a/internal/admin/dashboard/static/js/modules/execution-plans-layout.test.js
+++ b/internal/admin/dashboard/static/js/modules/execution-plans-layout.test.js
@@ -60,9 +60,19 @@ test('async label stays inline on the right side of the branch', () => {
         template,
         /<div class="ep-async-row">[\s\S]*ep-node-async-usage[\s\S]*ep-conn-async[\s\S]*ep-node-async-audit[\s\S]*<\/div>\s*<div class="ep-async-turn"><\/div>\s*<span class="ep-async-label">Async<\/span>/
     );
+    assert.match(
+        template,
+        /<div class="ep-conn ep-conn-async" x-show="{{\.}}\.showAudit"><\/div>\s*<div class="ep-node ep-node-feature ep-node-async ep-node-async-audit" x-show="{{\.}}\.showAudit">/
+    );
 
     const asyncLabelRule = readCSSRule(css, '.ep-async-label');
     assert.doesNotMatch(asyncLabelRule, /position:\s*absolute/);
+
+    const asyncUsageRule = readCSSRule(css, '.ep-node-async-usage');
+    assert.match(asyncUsageRule, /--accent:\s*var\(--success\)/);
+
+    const asyncAuditRule = readCSSRule(css, '.ep-node-async-audit');
+    assert.match(asyncAuditRule, /--accent:\s*var\(--warning\)/);
 });
 
 test('workflow nodes use endpoint and feature color groups consistently', () => {
@@ -71,45 +81,18 @@ test('workflow nodes use endpoint and feature color groups consistently', () =>
     const endpointRule = readCSSRule(css, '.ep-node-endpoint');
     assert.match(endpointRule, /background:\s*var\(--bg-surface\)/);
 
-    const featureSelectors = [
-        '.ep-node-cache',
-        '.ep-node-auth',
-        '.ep-node-guardrails',
-        '.ep-node-async-audit',
-        '.ep-node-async-usage'
-    ];
-    for (const selector of featureSelectors) {
-        const rule = readCSSRule(css, selector);
-        assert.match(rule, /border-color:\s*color-mix\(in srgb, var\(--accent\) 46%, var\(--border\)\)/);
-        assert.match(rule, /background:\s*color-mix\(in srgb, var\(--accent\) 8%, var\(--bg-surface\)\)/);
-    }
+    const featureRule = readCSSRule(css, '.ep-node-feature');
+    assert.match(featureRule, /border-color:\s*color-mix\(in srgb, var\(--accent\) 46%, var\(--border\)\)/);
+    assert.match(featureRule, /background:\s*color-mix\(in srgb, var\(--accent\) 8%, var\(--bg-surface\)\)/);
 
-    const featureIconSelectors = [
-        '.ep-node-cache .ep-node-icon',
-        '.ep-node-auth .ep-node-icon',
-        '.ep-node-guardrails .ep-node-icon',
-        '.ep-node-async-audit .ep-node-icon',
-        '.ep-node-async-usage .ep-node-icon'
-    ];
-    for (const selector of featureIconSelectors) {
-        const rule = readCSSRule(css, selector);
-        assert.match(rule, /background:\s*color-mix\(in srgb, var\(--accent\) 16%, var\(--bg\)\)/);
-        assert.match(rule, /color:\s*var\(--accent\)/);
-    }
+    const featureIconRule = readCSSRule(css, '.ep-node-feature .ep-node-icon');
+    assert.match(featureIconRule, /background:\s*color-mix\(in srgb, var\(--accent\) 16%, var\(--bg\)\)/);
+    assert.match(featureIconRule, /color:\s*var\(--accent\)/);
 
-    const featureLabelSelectors = [
-        '.ep-node-cache .ep-node-label',
-        '.ep-node-auth .ep-node-label',
-        '.ep-node-guardrails .ep-node-label',
-        '.ep-node-async-audit .ep-node-label',
-        '.ep-node-async-usage .ep-node-label'
-    ];
-    for (const selector of featureLabelSelectors) {
-        const rule = readCSSRule(css, selector);
-        assert.match(rule, /color:\s*var\(--accent\)/);
-    }
+    const featureLabelRule = readCSSRule(css, '.ep-node-feature .ep-node-label');
+    assert.match(featureLabelRule, /color:\s*var\(--accent\)/);
 
-    const authSubRule = readCSSRule(css, '.ep-node-auth .ep-node-sub');
+    const authSubRule = readCSSRule(css, '.ep-node-feature .ep-node-sub');
     assert.match(authSubRule, /color:\s*color-mix\(in srgb, var\(--accent\) 70%, var\(--text-muted\)\)/);
 });
 
@@ -118,7 +101,7 @@ test('auth node uses the cache iconography in execution plan charts', () => {
 
     assert.match(
         chartTemplate,
-        /<div class="ep-node ep-node-auth"[\s\S]*?<svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"\/><path d="M21 12c0 1\.66-4 3-9 3s-9-1\.34-9-3"\/><path d="M3 5v14c0 1\.66 4 3 9 3s9-1\.34 9-3V5"\/><\/svg>[\s\S]*?<span class="ep-node-label">Auth<\/span>/
+        /<div class="ep-node ep-node-feature ep-node-auth"[\s\S]*?<svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"\/><path d="M21 12c0 1\.66-4 3-9 3s-9-1\.34-9-3"\/><path d="M3 5v14c0 1\.66 4 3 9 3s9-1\.34 9-3V5"\/><\/svg>[\s\S]*?<span class="ep-node-label">Auth<\/span>/
     );
 });
 
@@ -245,7 +228,7 @@ test('audit log pipeline binds cache visibility and runtime highlight classes ac
 
     assert.match(
         template,
-        /{{template "execution-plan-chart" "executionPlanAuditChart\(entry\)"}}[\s\S]*<div class="ep-step" x-show="{{\.}}\.showCache">[\s\S]*:class="{{\.}}\.cacheNodeClass"[\s\S]*x-text="{{\.}}\.cacheStatusLabel"/
+        /{{template "execution-plan-chart" "executionPlanAuditChart\(entry\)"}}[\s\S]*<div class="ep-conn" x-show="{{\.}}\.showCache" :class="{{\.}}\.cacheConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-feature ep-node-cache" x-show="{{\.}}\.showCache" :class="{{\.}}\.cacheNodeClass">[\s\S]*x-text="{{\.}}\.cacheStatusLabel"/
     );
     assert.match(
         template,
@@ -253,28 +236,24 @@ test('audit log pipeline binds cache visibility and runtime highlight classes ac
     );
     assert.match(
         template,
-        /<div class="exec-pipeline" :class="\{ 'exec-pipeline-has-meta': {{\.}}\.workflowID \}">[\s\S]*<div class="exec-pipeline-meta" x-show="{{\.}}\.workflowID">[\s\S]*x-text="'id: ' \+ {{\.}}\.workflowID"/
+        /<div class="ep-conn" :class="{{\.}}\.aiConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-ai" :class="{{\.}}\.aiNodeClass">/
     );
     assert.match(
         template,
-        /<div class="ep-conn ep-conn-grow" :class="{{\.}}\.aiConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-ai" :class="{{\.}}\.aiNodeClass">/
+        /<div class="exec-pipeline" :class="\{ 'exec-pipeline-has-meta': {{\.}}\.workflowID \}">[\s\S]*<div class="exec-pipeline-meta" x-show="{{\.}}\.workflowID">[\s\S]*x-text="'id: ' \+ {{\.}}\.workflowID"/
     );
     assert.match(
         template,
-        /<div class="ep-conn ep-conn-grow" :class="{{\.}}\.responseConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-endpoint" :class="{{\.}}\.responseNodeClass">/
+        /<div class="ep-conn" :class="{{\.}}\.responseConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-endpoint" :class="{{\.}}\.responseNodeClass">/
     );
 
-    const aiSuccessRule = readCSSRule(css, '.ep-node-ai-success');
-    assert.match(aiSuccessRule, /border-color:\s*color-mix\(in srgb, var\(--success\) 52%, var\(--border\)\)/);
-    assert.match(aiSuccessRule, /background:\s*color-mix\(in srgb, var\(--success\) 9%, var\(--bg-surface\)\)/);
-
-    const endpointSuccessRule = readCSSRule(css, '.ep-node-endpoint-success');
-    assert.match(endpointSuccessRule, /border-color:\s*color-mix\(in srgb, var\(--success\) 52%, var\(--border\)\)/);
-    assert.match(endpointSuccessRule, /background:\s*color-mix\(in srgb, var\(--success\) 9%, var\(--bg-surface\)\)/);
+    const successRule = readCSSRule(css, '.ep-node-success');
+    assert.match(successRule, /border-color:\s*color-mix\(in srgb, var\(--success\) 52%, var\(--border\)\)/);
+    assert.match(successRule, /background:\s*color-mix\(in srgb, var\(--success\) 9%, var\(--bg-surface\)\)/);
 
-    const semanticCacheRule = readCSSRule(css, '.ep-node-cache-semantic');
-    assert.match(semanticCacheRule, /border-color:\s*color-mix\(in srgb, var\(--success\) 52%, var\(--border\)\)/);
-    assert.match(semanticCacheRule, /background:\s*color-mix\(in srgb, var\(--success\) 9%, var\(--bg-surface\)\)/);
+    const errorRule = readCSSRule(css, '.ep-node-error');
+    assert.match(errorRule, /border-color:\s*color-mix\(in srgb, var\(--danger\) 52%, var\(--border\)\)/);
+    assert.match(errorRule, /background:\s*color-mix\(in srgb, var\(--danger\) 9%, var\(--bg-surface\)\)/);
 
     const pipelineRule = readCSSRule(css, '.exec-pipeline');
     assert.match(pipelineRule, /position:\s*relative/);
@@ -284,19 +263,37 @@ test('audit log pipeline binds cache visibility and runtime highlight classes ac
     assert.match(metaRule, /top:\s*12px/);
     assert.match(metaRule, /right:\s*14px/);
 
-    const authSuccessRule = readCSSRule(css, '.ep-node-auth-success');
-    assert.match(authSuccessRule, /border-color:\s*color-mix\(in srgb, var\(--success\) 52%, var\(--border\)\)/);
-    assert.match(authSuccessRule, /background:\s*color-mix\(in srgb, var\(--success\) 9%, var\(--bg-surface\)\)/);
-
-    const authErrorRule = readCSSRule(css, '.ep-node-auth-error');
-    assert.match(authErrorRule, /border-color:\s*color-mix\(in srgb, var\(--danger\) 52%, var\(--border\)\)/);
-    assert.match(authErrorRule, /background:\s*color-mix\(in srgb, var\(--danger\) 9%, var\(--bg-surface\)\)/);
-
-    const skippedAiRule = readCSSRule(css, '.ep-node-ai-skipped');
+    const skippedAiRule = readCSSRule(css, '.ep-node-skipped');
     assert.match(skippedAiRule, /position:\s*relative/);
     assert.match(skippedAiRule, /opacity:\s*0\.28/);
 });
 
+test('execution pipeline main row is flattened without ep-left or ep-right wrappers', () => {
+    const template = readFixture('../../../templates/execution-plan-chart.html');
+    const css = readFixture('../../css/dashboard.css');
+
+    assert.doesNotMatch(template, /class="ep-left"/);
+    assert.doesNotMatch(template, /class="ep-right"/);
+    assert.doesNotMatch(template, /class="ep-step"/);
+    assert.match(
+        template,
+        /<div class="exec-pipeline-row">[\s\S]*<div class="ep-node ep-node-endpoint">[\s\S]*<div class="ep-conn"><\/div>[\s\S]*<div class="ep-node ep-node-feature ep-node-auth"[\s\S]*<div class="ep-conn" :class="{{\.}}\.aiConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-ai" :class="{{\.}}\.aiNodeClass">[\s\S]*<div class="ep-conn" :class="{{\.}}\.responseConnClass"><\/div>[\s\S]*<div class="ep-node ep-node-endpoint" :class="{{\.}}\.responseNodeClass">/
+    );
+    assert.doesNotMatch(css, /\.ep-left\s*,/);
+    assert.doesNotMatch(css, /\.ep-right\s*\{/);
+    assert.doesNotMatch(css, /\.ep-step\s*\{/);
+    assert.doesNotMatch(css, /\.ep-conn-grow\s*\{/);
+});
+
+test('execution pipeline main-row connectors share the row width evenly', () => {
+    const css = readFixture('../../css/dashboard.css');
+    const connRule = readCSSRule(css, '.ep-conn');
+
+    assert.match(connRule, /flex:\s*1 1 0/);
+    assert.match(connRule, /min-width:\s*13px/);
+    assert.match(connRule, /width:\s*auto/);
+});
+
 test('execution plan card actions expose plan-specific accessible names', () => {
     const template = readFixture('../../../templates/index.html');
 
diff --git a/internal/admin/dashboard/static/js/modules/execution-plans.js b/internal/admin/dashboard/static/js/modules/execution-plans.js
index 7e31ca5d..402f2658 100644
--- a/internal/admin/dashboard/static/js/modules/execution-plans.js
+++ b/internal/admin/dashboard/static/js/modules/execution-plans.js
@@ -1152,10 +1152,7 @@
             },
 
             epCacheNodeClass(runtime) {
-                if (!runtime || !runtime.cacheHit) return '';
-                if (runtime.cacheHit && runtime.cacheType === 'semantic') return 'ep-node-cache-semantic';
-                if (runtime.cacheHit) return 'ep-node-cache-hit';
-                return '';
+                return runtime && runtime.cacheHit ? 'ep-node-success' : '';
             },
 
             epCacheConnClass(runtime) {
@@ -1176,8 +1173,8 @@
 
             epAiNodeClass(runtime) {
                 if (!runtime) return '';
-                if (runtime.cacheHit) return 'ep-node-ai-skipped';
-                return runtime.aiSuccess ? 'ep-node-ai-success' : '';
+                if (runtime.cacheHit) return 'ep-node-skipped';
+                return runtime.aiSuccess ? 'ep-node-success' : '';
             },
 
             epResponseConnClass(runtime) {
@@ -1188,13 +1185,13 @@
 
             epResponseNodeClass(runtime) {
                 if (!runtime) return '';
-                return runtime.responseSuccess ? 'ep-node-endpoint-success' : '';
+                return runtime.responseSuccess ? 'ep-node-success' : '';
             },
 
             epAuthNodeClass(runtime) {
                 if (!runtime) return '';
-                if (runtime.authError) return 'ep-node-auth-error';
-                if (runtime.authMethod === 'api_key' || runtime.authMethod === 'master_key') return 'ep-node-auth-success';
+                if (runtime.authError) return 'ep-node-error';
+                if (runtime.authMethod === 'api_key' || runtime.authMethod === 'master_key') return 'ep-node-success';
                 return '';
             },
 
diff --git a/internal/admin/dashboard/static/js/modules/execution-plans.test.js b/internal/admin/dashboard/static/js/modules/execution-plans.test.js
index 08513682..b2d687a3 100644
--- a/internal/admin/dashboard/static/js/modules/execution-plans.test.js
+++ b/internal/admin/dashboard/static/js/modules/execution-plans.test.js
@@ -319,15 +319,15 @@ test('executionPlanAuditChart returns the shared chart contract for audit runtim
             showGuardrails: true,
             guardrailLabel: '1 step',
             showCache: true,
-            cacheNodeClass: 'ep-node-cache-semantic',
+            cacheNodeClass: 'ep-node-success',
             cacheConnClass: 'ep-conn-hit',
             cacheStatusLabel: 'Hit (Semantic)',
             aiLabel: 'openai',
             aiSublabel: 'gpt-5',
             aiConnClass: 'ep-conn-dim',
-            aiNodeClass: 'ep-node-ai-skipped',
+            aiNodeClass: 'ep-node-skipped',
             responseConnClass: 'ep-conn-dim',
-            responseNodeClass: 'ep-node-endpoint-success',
+            responseNodeClass: 'ep-node-success',
             authNodeClass: '',
             authNodeSublabel: null,
             showAsync: true,
@@ -353,15 +353,15 @@ test('executionPlanAuditChart forces audit nodes even when the workflow version
             showGuardrails: false,
             guardrailLabel: '',
             showCache: true,
-            cacheNodeClass: 'ep-node-cache-hit',
+            cacheNodeClass: 'ep-node-success',
             cacheConnClass: 'ep-conn-hit',
             cacheStatusLabel: 'Hit (Exact)',
             aiLabel: 'openai',
             aiSublabel: 'gpt-5',
             aiConnClass: 'ep-conn-dim',
-            aiNodeClass: 'ep-node-ai-skipped',
+            aiNodeClass: 'ep-node-skipped',
             responseConnClass: 'ep-conn-dim',
-            responseNodeClass: 'ep-node-endpoint-success',
+            responseNodeClass: 'ep-node-success',
             authNodeClass: '',
             authNodeSublabel: null,
             showAsync: true,
@@ -422,9 +422,9 @@ test('executionPlanAuditChart prefers request-time execution features over curre
             aiLabel: 'openai',
             aiSublabel: 'gpt-5',
             aiConnClass: '',
-            aiNodeClass: 'ep-node-ai-success',
+            aiNodeClass: 'ep-node-success',
             responseConnClass: '',
-            responseNodeClass: 'ep-node-endpoint-success',
+            responseNodeClass: 'ep-node-success',
             authNodeClass: '',
             authNodeSublabel: null,
             showAsync: true,
@@ -1546,13 +1546,13 @@ test('audit runtime uses explicit cache-hit labels and highlights the uncached 2
         cache_type: 'semantic',
         status_code: 200
     });
-    assert.equal(module.epCacheNodeClass(semanticHit), 'ep-node-cache-semantic');
+    assert.equal(module.epCacheNodeClass(semanticHit), 'ep-node-success');
     assert.equal(module.epCacheConnClass(semanticHit), 'ep-conn-hit');
     assert.equal(module.epCacheStatusLabel(semanticHit), 'Hit (Semantic)');
     assert.equal(module.epAiConnClass(semanticHit), 'ep-conn-dim');
-    assert.equal(module.epAiNodeClass(semanticHit), 'ep-node-ai-skipped');
+    assert.equal(module.epAiNodeClass(semanticHit), 'ep-node-skipped');
     assert.equal(module.epResponseConnClass(semanticHit), 'ep-conn-dim');
-    assert.equal(module.epResponseNodeClass(semanticHit), 'ep-node-endpoint-success');
+    assert.equal(module.epResponseNodeClass(semanticHit), 'ep-node-success');
 
     const uncachedSuccess = module.epRuntimeFromEntry({
         provider: 'openai',
@@ -1563,9 +1563,9 @@ test('audit runtime uses explicit cache-hit labels and highlights the uncached 2
     assert.equal(module.epCacheNodeClass(uncachedSuccess), '');
     assert.equal(module.epCacheStatusLabel(uncachedSuccess), null);
     assert.equal(module.epAiConnClass(uncachedSuccess), '');
-    assert.equal(module.epAiNodeClass(uncachedSuccess), 'ep-node-ai-success');
+    assert.equal(module.epAiNodeClass(uncachedSuccess), 'ep-node-success');
     assert.equal(module.epResponseConnClass(uncachedSuccess), '');
-    assert.equal(module.epResponseNodeClass(uncachedSuccess), 'ep-node-endpoint-success');
+    assert.equal(module.epResponseNodeClass(uncachedSuccess), 'ep-node-success');
 });
 
 test('epRuntimeFromEntry treats any uncached 2xx status as a successful AI and response path', () => {
@@ -1598,14 +1598,14 @@ test('auth runtime highlights auth node state from audit entries', () => {
         auth_method: 'api_key',
         error_type: 'authentication_error'
     });
-    assert.equal(module.epAuthNodeClass(failedAuth), 'ep-node-auth-error');
+    assert.equal(module.epAuthNodeClass(failedAuth), 'ep-node-error');
     assert.equal(module.epAuthNodeSublabel(failedAuth), 'api_key');
 
     const masterKeyAuth = module.epRuntimeFromEntry({
         auth_method: 'master_key',
         status_code: 200
     });
-    assert.equal(module.epAuthNodeClass(masterKeyAuth), 'ep-node-auth-success');
+    assert.equal(module.epAuthNodeClass(masterKeyAuth), 'ep-node-success');
     assert.equal(module.epAuthNodeSublabel(masterKeyAuth), 'master_key');
 });
 
diff --git a/internal/admin/dashboard/static/js/modules/guardrails.js b/internal/admin/dashboard/static/js/modules/guardrails.js
new file mode 100644
index 00000000..1276e79a
--- /dev/null
+++ b/internal/admin/dashboard/static/js/modules/guardrails.js
@@ -0,0 +1,365 @@
+(function(global) {
+    function dashboardGuardrailsModule() {
+        return {
+            guardrails: [],
+            guardrailTypes: [],
+            guardrailsAvailable: true,
+            guardrailsLoading: false,
+            guardrailTypesLoading: false,
+            guardrailError: '',
+            guardrailNotice: '',
+            guardrailFilter: '',
+            guardrailFormOpen: false,
+            guardrailFormSubmitting: false,
+            guardrailDeletingName: '',
+            guardrailFormMode: 'create',
+            guardrailFormOriginalName: '',
+            guardrailForm: {
+                name: '',
+                type: '',
+                description: '',
+                config: {}
+            },
+
+            cloneGuardrailJSON(value) {
+                try {
+                    const cloned = JSON.parse(JSON.stringify(value || {}));
+                    return cloned && typeof cloned === 'object' && !Array.isArray(cloned) ? cloned : {};
+                } catch (_) {
+                    return {};
+                }
+            },
+
+            defaultGuardrailType() {
+                if (Array.isArray(this.guardrailTypes) && this.guardrailTypes.length > 0) {
+                    return String(this.guardrailTypes[0].type || '').trim() || 'system_prompt';
+                }
+                return 'system_prompt';
+            },
+
+            guardrailTypeDefinition(type) {
+                const normalized = String(type || '').trim();
+                return (this.guardrailTypes || []).find((item) => String(item && item.type || '').trim() === normalized) || null;
+            },
+
+            defaultGuardrailConfig(type) {
+                const definition = this.guardrailTypeDefinition(type);
+                if (!definition || !definition.defaults) {
+                    return {};
+                }
+                return this.cloneGuardrailJSON(definition.defaults);
+            },
+
+            normalizeGuardrailConfig(config, type) {
+                return {
+                    ...this.defaultGuardrailConfig(type),
+                    ...this.cloneGuardrailJSON(config)
+                };
+            },
+
+            defaultGuardrailForm(type) {
+                const resolvedType = String(type || '').trim() || this.defaultGuardrailType();
+                return {
+                    name: '',
+                    type: resolvedType,
+                    description: '',
+                    user_path: '',
+                    config: this.defaultGuardrailConfig(resolvedType)
+                };
+            },
+
+            get filteredGuardrails() {
+                if (!this.guardrailFilter) {
+                    return this.guardrails;
+                }
+                const filter = this.guardrailFilter.toLowerCase();
+                return (this.guardrails || []).filter((guardrail) => {
+                    const fields = [
+                        guardrail.name,
+                        guardrail.type,
+                        guardrail.user_path,
+                        guardrail.description,
+                        guardrail.summary
+                    ];
+                    return fields.some((value) => String(value || '').toLowerCase().includes(filter));
+                });
+            },
+
+            guardrailTypeLabel(type) {
+                const definition = this.guardrailTypeDefinition(type);
+                return definition && definition.label ? definition.label : (type || 'Unknown');
+            },
+
+            guardrailTypeFields(type) {
+                const definition = this.guardrailTypeDefinition(type);
+                return Array.isArray(definition && definition.fields) ? definition.fields : [];
+            },
+
+            guardrailFieldValue(field) {
+                if (!field || !this.guardrailForm || !this.guardrailForm.config) {
+                    return '';
+                }
+                const value = this.guardrailForm.config[field.key];
+                if (value === null || value === undefined) {
+                    return '';
+                }
+                return value;
+            },
+
+            setGuardrailFieldValue(field, value) {
+                if (!field) {
+                    return;
+                }
+                const nextConfig = this.cloneGuardrailJSON(this.guardrailForm.config);
+                if (field.input === 'number') {
+                    const trimmed = String(value || '').trim();
+                    if (trimmed === '') {
+                        delete nextConfig[field.key];
+                    } else {
+                        const parsed = Number(trimmed);
+                        nextConfig[field.key] = Number.isFinite(parsed) ? parsed : trimmed;
+                    }
+                } else {
+                    nextConfig[field.key] = value;
+                }
+                this.guardrailForm = {
+                    ...this.guardrailForm,
+                    config: nextConfig
+                };
+            },
+
+            guardrailsRuntimeEnabled() {
+                if (typeof this.executionPlanRuntimeBooleanFlag === 'function') {
+                    return this.executionPlanRuntimeBooleanFlag('GUARDRAILS_ENABLED', true);
+                }
+                return true;
+            },
+
+            openGuardrailCreate() {
+                this.guardrailFormMode = 'create';
+                this.guardrailFormOriginalName = '';
+                this.guardrailError = '';
+                this.guardrailNotice = '';
+                this.guardrailForm = this.defaultGuardrailForm(this.defaultGuardrailType());
+                this.guardrailFormOpen = true;
+            },
+
+            openGuardrailEdit(guardrail) {
+                const resolvedType = String(guardrail && guardrail.type || '').trim() || this.defaultGuardrailType();
+                this.guardrailFormMode = 'edit';
+                this.guardrailFormOriginalName = String(guardrail && guardrail.name || '').trim();
+                this.guardrailError = '';
+                this.guardrailNotice = '';
+                this.guardrailForm = {
+                    name: this.guardrailFormOriginalName,
+                    type: resolvedType,
+                    description: String(guardrail && guardrail.description || '').trim(),
+                    user_path: String(guardrail && guardrail.user_path || '').trim(),
+                    config: this.normalizeGuardrailConfig(guardrail && guardrail.config, resolvedType)
+                };
+                this.guardrailFormOpen = true;
+            },
+
+            closeGuardrailForm() {
+                this.guardrailFormOpen = false;
+                this.guardrailFormMode = 'create';
+                this.guardrailFormOriginalName = '';
+                this.guardrailError = '';
+                this.guardrailForm = this.defaultGuardrailForm(this.defaultGuardrailType());
+            },
+
+            onGuardrailTypeChange() {
+                const resolvedType = String(this.guardrailForm.type || '').trim() || this.defaultGuardrailType();
+                this.guardrailForm = {
+                    ...this.guardrailForm,
+                    type: resolvedType,
+                    config: this.defaultGuardrailConfig(resolvedType)
+                };
+            },
+
+            async guardrailResponseMessage(res, fallback) {
+                try {
+                    const payload = await res.json();
+                    if (payload && payload.error && payload.error.message) {
+                        return payload.error.message;
+                    }
+                } catch (_) {
+                    // Ignore invalid or empty responses and return the fallback message.
+                }
+                return fallback;
+            },
+
+            async fetchGuardrailTypes() {
+                this.guardrailTypesLoading = true;
+                try {
+                    const res = await fetch('/admin/api/v1/guardrails/types', { headers: this.headers() });
+                    if (res.status === 503) {
+                        this.guardrailsAvailable = false;
+                        this.guardrailTypes = [];
+                        return;
+                    }
+                    this.guardrailsAvailable = true;
+                    if (!this.handleFetchResponse(res, 'guardrail types')) {
+                        this.guardrailTypes = [];
+                        return;
+                    }
+                    const payload = await res.json();
+                    this.guardrailTypes = Array.isArray(payload) ? payload : [];
+                    if (!this.guardrailForm.type) {
+                        this.guardrailForm = this.defaultGuardrailForm(this.defaultGuardrailType());
+                    }
+                } catch (e) {
+                    console.error('Failed to fetch guardrail types:', e);
+                    this.guardrailTypes = [];
+                    this.guardrailError = 'Unable to load guardrail types.';
+                } finally {
+                    this.guardrailTypesLoading = false;
+                }
+            },
+
+            async fetchGuardrails() {
+                this.guardrailsLoading = true;
+                this.guardrailError = '';
+                try {
+                    const res = await fetch('/admin/api/v1/guardrails', { headers: this.headers() });
+                    if (res.status === 503) {
+                        this.guardrailsAvailable = false;
+                        this.guardrails = [];
+                        return;
+                    }
+                    this.guardrailsAvailable = true;
+                    if (!this.handleFetchResponse(res, 'guardrails')) {
+                        this.guardrails = [];
+                        return;
+                    }
+                    const payload = await res.json();
+                    this.guardrails = Array.isArray(payload) ? payload : [];
+                } catch (e) {
+                    console.error('Failed to fetch guardrails:', e);
+                    this.guardrails = [];
+                    this.guardrailError = 'Unable to load guardrails.';
+                } finally {
+                    this.guardrailsLoading = false;
+                }
+            },
+
+            async fetchGuardrailsPage() {
+                await Promise.all([
+                    this.fetchGuardrailTypes(),
+                    this.fetchGuardrails()
+                ]);
+            },
+
+            async submitGuardrailForm() {
+                const name = String(this.guardrailForm.name || '').trim();
+                const type = String(this.guardrailForm.type || '').trim();
+                if (!name) {
+                    this.guardrailError = 'Name is required.';
+                    return;
+                }
+                if (!type) {
+                    this.guardrailError = 'Type is required.';
+                    return;
+                }
+
+                this.guardrailError = '';
+                this.guardrailNotice = '';
+                this.guardrailFormSubmitting = true;
+
+                const payload = {
+                    type,
+                    description: String(this.guardrailForm.description || '').trim() || undefined,
+                    user_path: String(this.guardrailForm.user_path || '').trim() || undefined,
+                    config: this.cloneGuardrailJSON(this.guardrailForm.config)
+                };
+
+                try {
+                    const res = await fetch('/admin/api/v1/guardrails/' + encodeURIComponent(name), {
+                        method: 'PUT',
+                        headers: this.headers(),
+                        body: JSON.stringify(payload)
+                    });
+                    if (res.status === 503) {
+                        this.guardrailsAvailable = false;
+                        this.guardrailError = 'Guardrails feature is unavailable.';
+                        return;
+                    }
+                    if (res.status === 401) {
+                        this.authError = true;
+                        this.needsAuth = true;
+                        this.guardrailError = 'Authentication required.';
+                        return;
+                    }
+                    if (res.status !== 200) {
+                        this.guardrailError = await this.guardrailResponseMessage(res, 'Failed to save guardrail.');
+                        return;
+                    }
+
+                    await this.fetchGuardrails();
+                    if (typeof this.fetchExecutionPlanGuardrails === 'function') {
+                        this.fetchExecutionPlanGuardrails();
+                    }
+                    this.guardrailNotice = 'Guardrail "' + name + '" saved.';
+                    this.closeGuardrailForm();
+                } catch (e) {
+                    console.error('Failed to save guardrail:', e);
+                    this.guardrailError = 'Failed to save guardrail.';
+                } finally {
+                    this.guardrailFormSubmitting = false;
+                }
+            },
+
+            async deleteGuardrail(guardrail) {
+                const name = String(guardrail && guardrail.name || '').trim();
+                if (!name || this.guardrailDeletingName) {
+                    return;
+                }
+                if (!window.confirm('Delete guardrail "' + name + '"? Workflows that still reference it must be updated first.')) {
+                    return;
+                }
+
+                this.guardrailDeletingName = name;
+                this.guardrailError = '';
+                this.guardrailNotice = '';
+
+                try {
+                    const res = await fetch('/admin/api/v1/guardrails/' + encodeURIComponent(name), {
+                        method: 'DELETE',
+                        headers: this.headers()
+                    });
+                    if (res.status === 503) {
+                        this.guardrailsAvailable = false;
+                        this.guardrailError = 'Guardrails feature is unavailable.';
+                        return;
+                    }
+                    if (res.status === 401) {
+                        this.authError = true;
+                        this.needsAuth = true;
+                        this.guardrailError = 'Authentication required.';
+                        return;
+                    }
+                    if (res.status !== 204) {
+                        this.guardrailError = await this.guardrailResponseMessage(res, 'Failed to delete guardrail.');
+                        return;
+                    }
+
+                    await this.fetchGuardrails();
+                    if (typeof this.fetchExecutionPlanGuardrails === 'function') {
+                        this.fetchExecutionPlanGuardrails();
+                    }
+                    if (this.guardrailFormOpen && this.guardrailFormOriginalName === name) {
+                        this.closeGuardrailForm();
+                    }
+                    this.guardrailNotice = 'Guardrail "' + name + '" deleted.';
+                } catch (e) {
+                    console.error('Failed to delete guardrail:', e);
+                    this.guardrailError = 'Failed to delete guardrail.';
+                } finally {
+                    this.guardrailDeletingName = '';
+                }
+            }
+        };
+    }
+
+    global.dashboardGuardrailsModule = dashboardGuardrailsModule;
+})(window);
diff --git a/internal/admin/dashboard/static/js/modules/guardrails.test.js b/internal/admin/dashboard/static/js/modules/guardrails.test.js
new file mode 100644
index 00000000..64dccf0a
--- /dev/null
+++ b/internal/admin/dashboard/static/js/modules/guardrails.test.js
@@ -0,0 +1,79 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+
+function loadGuardrailsModuleFactory() {
+    const source = fs.readFileSync(path.join(__dirname, 'guardrails.js'), 'utf8');
+    const context = {
+        window: {},
+        console
+    };
+    vm.createContext(context);
+    vm.runInContext(source, context);
+    return context.window.dashboardGuardrailsModule;
+}
+
+function createGuardrailsModule() {
+    const factory = loadGuardrailsModuleFactory();
+    return factory();
+}
+
+test('defaultGuardrailForm uses the first available type defaults', () => {
+    const module = createGuardrailsModule();
+    module.guardrailTypes = [
+        {
+            type: 'system_prompt',
+            defaults: { mode: 'inject', content: '' },
+            fields: []
+        }
+    ];
+
+    const form = module.defaultGuardrailForm();
+
+    assert.equal(form.type, 'system_prompt');
+    assert.equal(form.user_path, '');
+    assert.equal(JSON.stringify(form.config), JSON.stringify({ mode: 'inject', content: '' }));
+});
+
+test('normalizeGuardrailConfig merges stored config over type defaults', () => {
+    const module = createGuardrailsModule();
+    module.guardrailTypes = [
+        {
+            type: 'system_prompt',
+            defaults: { mode: 'inject', content: '' },
+            fields: []
+        }
+    ];
+
+    const config = module.normalizeGuardrailConfig({ content: 'be careful' }, 'system_prompt');
+
+    assert.equal(JSON.stringify(config), JSON.stringify({ mode: 'inject', content: 'be careful' }));
+});
+
+test('normalizeGuardrailConfig returns the input config for unknown types', () => {
+    const module = createGuardrailsModule();
+    module.guardrailTypes = [
+        {
+            type: 'system_prompt',
+            defaults: { mode: 'inject', content: '' },
+            fields: []
+        }
+    ];
+
+    const config = module.normalizeGuardrailConfig({ content: 'test' }, 'unknown_type');
+
+    assert.equal(JSON.stringify(config), JSON.stringify({ content: 'test' }));
+});
+
+test('filteredGuardrails matches user_path values', () => {
+    const module = createGuardrailsModule();
+    module.guardrails = [
+        { name: 'policy', type: 'system_prompt', user_path: '/team/alpha', summary: 'be careful' }
+    ];
+    module.guardrailFilter = 'alpha';
+
+    assert.equal(module.filteredGuardrails.length, 1);
+    assert.equal(module.filteredGuardrails[0].name, 'policy');
+});
diff --git a/internal/admin/dashboard/static/js/modules/timezone-layout.test.js b/internal/admin/dashboard/static/js/modules/timezone-layout.test.js
index fe38b591..f4747ab5 100644
--- a/internal/admin/dashboard/static/js/modules/timezone-layout.test.js
+++ b/internal/admin/dashboard/static/js/modules/timezone-layout.test.js
@@ -32,7 +32,9 @@ test('dashboard templates expose a settings page and timezone context in activit
     const helperTemplate = readFixture('../../../templates/helper-disclosure.html');
     const css = readFixture('../../css/dashboard.css');
 
-    assert.match(template, /<div x-show="page==='settings'">[\s\S]*<h2>User Settings<\/h2>/);
+    assert.match(template, /<div x-show="page==='settings'">[\s\S]*<h2>Settings<\/h2>/);
+    assert.match(template, /@click="navigateSettings\('general'\)"/);
+    assert.doesNotMatch(template, /@click="navigateSettings\('guardrails'\)"/);
     assert.match(template, /x-ref="timezoneOverrideSelect"/);
     assert.match(template, /x-model="timezoneOverride"/);
     assert.match(template, /x-effect="timezoneOptions\.length; timezoneOverride; \$nextTick\(\(\) => syncTimezoneOverrideSelectValue\(\)\)"/);
@@ -98,3 +100,13 @@ test('dashboard templates expose a settings page and timezone context in activit
     assert.doesNotMatch(copyRule, /background:/);
     assert.doesNotMatch(copyRule, /padding:/);
 });
+
+test('guardrails authoring moved to a top-level page while settings keeps the general switch', () => {
+    const template = readHelperDisclosureTemplateSource();
+
+    assert.match(template, /<div class="settings-subnav">[\s\S]*class="settings-subnav-btn active"[\s\S]*>General<\/button>/);
+    assert.match(template, /<div x-show="page==='guardrails'">[\s\S]*<h2>Guardrails<\/h2>/);
+    assert.match(template, /Guardrail Library/);
+    assert.match(template, /x-model="guardrailForm\.user_path"[^>]*aria-label="Guardrail user path"/);
+    assert.match(template, /Reserved for future UI visibility scoping\. It does not affect runtime execution yet\./);
+});
diff --git a/internal/admin/dashboard/templates/execution-plan-chart.html b/internal/admin/dashboard/templates/execution-plan-chart.html
index 56fef690..837ab55d 100644
--- a/internal/admin/dashboard/templates/execution-plan-chart.html
+++ b/internal/admin/dashboard/templates/execution-plan-chart.html
@@ -4,78 +4,66 @@
         <span class="exec-pipeline-meta-chip mono" x-show="{{.}}.workflowID" x-text="'id: ' + {{.}}.workflowID"></span>
     </div>
     <div class="exec-pipeline-row">
-        <div class="ep-left">
-            <div class="ep-node ep-node-endpoint">
-                <div class="ep-node-icon ep-node-icon-endpoint">
-                    <svg viewBox="0 0 24 24"><circle cx="12" cy="7" r="4"/><path d="M4 21v-1a8 8 0 0 1 16 0v1"/></svg>
-                </div>
-                <span class="ep-node-label">Client</span>
+        <div class="ep-node ep-node-endpoint">
+            <div class="ep-node-icon ep-node-icon-endpoint">
+                <svg viewBox="0 0 24 24"><circle cx="12" cy="7" r="4"/><path d="M4 21v-1a8 8 0 0 1 16 0v1"/></svg>
             </div>
+            <span class="ep-node-label">Client</span>
+        </div>
 
-            <div class="ep-step">
-                <div class="ep-conn"></div>
-                <div class="ep-node ep-node-auth" :class="{{.}}.authNodeClass">
-                    <div class="ep-node-icon">
-                        <svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"/><path d="M21 12c0 1.66-4 3-9 3s-9-1.34-9-3"/><path d="M3 5v14c0 1.66 4 3 9 3s9-1.34 9-3V5"/></svg>
-                    </div>
-                    <span class="ep-node-label">Auth</span>
-                    <span class="ep-node-sub" x-show="{{.}}.authNodeSublabel" x-text="{{.}}.authNodeSublabel"></span>
-                </div>
+        <div class="ep-conn"></div>
+        <div class="ep-node ep-node-feature ep-node-auth" :class="{{.}}.authNodeClass">
+            <div class="ep-node-icon">
+                <svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"/><path d="M21 12c0 1.66-4 3-9 3s-9-1.34-9-3"/><path d="M3 5v14c0 1.66 4 3 9 3s9-1.34 9-3V5"/></svg>
             </div>
+            <span class="ep-node-label">Auth</span>
+            <span class="ep-node-sub" x-show="{{.}}.authNodeSublabel" x-text="{{.}}.authNodeSublabel"></span>
+        </div>
 
-            <div class="ep-step" x-show="{{.}}.showGuardrails">
-                <div class="ep-conn"></div>
-                <div class="ep-node ep-node-guardrails">
-                    <div class="ep-node-icon">
-                        <svg viewBox="0 0 24 24"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
-                    </div>
-                    <span class="ep-node-label">Guardrails</span>
-                    <span class="ep-node-sub" x-show="{{.}}.guardrailLabel" x-text="{{.}}.guardrailLabel"></span>
-                </div>
+        <div class="ep-conn" x-show="{{.}}.showGuardrails"></div>
+        <div class="ep-node ep-node-feature ep-node-guardrails" x-show="{{.}}.showGuardrails">
+            <div class="ep-node-icon">
+                <svg viewBox="0 0 24 24"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
             </div>
+            <span class="ep-node-label">Guardrails</span>
+            <span class="ep-node-sub" x-show="{{.}}.guardrailLabel" x-text="{{.}}.guardrailLabel"></span>
+        </div>
 
-            <div class="ep-step" x-show="{{.}}.showCache">
-                <div class="ep-conn" :class="{{.}}.cacheConnClass"></div>
-                <div class="ep-node ep-node-cache" :class="{{.}}.cacheNodeClass">
-                    <div class="ep-node-icon">
-                        <svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"/><path d="M21 12c0 1.66-4 3-9 3s-9-1.34-9-3"/><path d="M3 5v14c0 1.66 4 3 9 3s9-1.34 9-3V5"/></svg>
-                    </div>
-                    <span class="ep-node-label">Cache</span>
-                    <span class="ep-node-badge" x-show="{{.}}.cacheStatusLabel" x-text="{{.}}.cacheStatusLabel"></span>
-                </div>
+        <div class="ep-conn" x-show="{{.}}.showCache" :class="{{.}}.cacheConnClass"></div>
+        <div class="ep-node ep-node-feature ep-node-cache" x-show="{{.}}.showCache" :class="{{.}}.cacheNodeClass">
+            <div class="ep-node-icon">
+                <svg viewBox="0 0 24 24"><ellipse cx="12" cy="5" rx="9" ry="3"/><path d="M21 12c0 1.66-4 3-9 3s-9-1.34-9-3"/><path d="M3 5v14c0 1.66 4 3 9 3s9-1.34 9-3V5"/></svg>
             </div>
-
-            <div class="ep-conn ep-conn-grow" :class="{{.}}.aiConnClass"></div>
+            <span class="ep-node-label">Cache</span>
+            <span class="ep-node-badge" x-show="{{.}}.cacheStatusLabel" x-text="{{.}}.cacheStatusLabel"></span>
         </div>
 
+        <div class="ep-conn" :class="{{.}}.aiConnClass"></div>
+
         <div class="ep-node ep-node-ai" :class="{{.}}.aiNodeClass">
             <span class="ep-node-label" x-text="{{.}}.aiLabel"></span>
             <span class="ep-node-sub" x-show="{{.}}.aiSublabel" x-text="{{.}}.aiSublabel"></span>
         </div>
 
-        <div class="ep-right">
-            <div class="ep-conn ep-conn-grow" :class="{{.}}.responseConnClass"></div>
-            <div class="ep-node ep-node-endpoint" :class="{{.}}.responseNodeClass">
-                <div class="ep-node-icon ep-node-icon-endpoint">
-                    <svg viewBox="0 0 24 24"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
-                </div>
-                <span class="ep-node-label">Response</span>
+        <div class="ep-conn" :class="{{.}}.responseConnClass"></div>
+        <div class="ep-node ep-node-endpoint" :class="{{.}}.responseNodeClass">
+            <div class="ep-node-icon ep-node-icon-endpoint">
+                <svg viewBox="0 0 24 24"><path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg>
             </div>
+            <span class="ep-node-label">Response</span>
         </div>
     </div>
 
     <div class="ep-async-section" x-show="{{.}}.showAsync">
         <div class="ep-async-row">
-            <div class="ep-node ep-node-async ep-node-async-usage" x-show="{{.}}.showUsage">
+            <div class="ep-node ep-node-feature ep-node-async ep-node-async-usage" x-show="{{.}}.showUsage">
                 <div class="ep-node-icon">
                     <svg viewBox="0 0 24 24"><line x1="18" y1="20" x2="18" y2="10"/><line x1="12" y1="20" x2="12" y2="4"/><line x1="6" y1="20" x2="6" y2="14"/></svg>
                 </div>
                 <span class="ep-node-label">Usage</span>
             </div>
-            <div class="ep-step" x-show="{{.}}.showUsage && {{.}}.showAudit">
-                <div class="ep-conn ep-conn-async"></div>
-            </div>
-            <div class="ep-node ep-node-async ep-node-async-audit" x-show="{{.}}.showAudit">
+            <div class="ep-conn ep-conn-async" x-show="{{.}}.showAudit"></div>
+            <div class="ep-node ep-node-feature ep-node-async ep-node-async-audit" x-show="{{.}}.showAudit">
                 <div class="ep-node-icon">
                     <svg viewBox="0 0 24 24"><path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"/><polyline points="14 2 14 8 20 8"/><line x1="16" y1="13" x2="8" y2="13"/><line x1="16" y1="17" x2="8" y2="17"/></svg>
                 </div>
diff --git a/internal/admin/dashboard/templates/index.html b/internal/admin/dashboard/templates/index.html
index 96035ecc..aa29545b 100644
--- a/internal/admin/dashboard/templates/index.html
+++ b/internal/admin/dashboard/templates/index.html
@@ -228,7 +228,14 @@ <h3>Request Log</h3>
 <!-- Settings Page -->
 <div x-show="page==='settings'">
     <div class="page-header">
-        <h2>User Settings</h2>
+        <div>
+            <h2>Settings</h2>
+            <p class="page-subtitle">Dashboard preferences.</p>
+        </div>
+    </div>
+
+    <div class="settings-subnav">
+        <button type="button" class="settings-subnav-btn active" @click="navigateSettings('general')">General</button>
     </div>
 
     <div class="settings-panel">
@@ -253,6 +260,162 @@ <h2>User Settings</h2>
     </div>
 </div>
 
+<!-- Guardrails Page -->
+<div x-show="page==='guardrails'">
+    <div class="page-header">
+        <div>
+            <h2>Guardrails</h2>
+            <p class="page-subtitle">Reusable policy objects stored in the database and kept hot in memory for workflow execution.</p>
+        </div>
+    </div>
+
+    <div class="settings-guardrails-hero">
+        <div>
+            <p class="settings-kicker">Reusable Policy Objects</p>
+            <h3>Guardrail Library</h3>
+            <p>Store guardrails in the database, keep them hot in memory, and attach them to workflows by reference.</p>
+        </div>
+        <div class="settings-guardrails-meta">
+            <div class="settings-guardrails-stat">
+                <span class="settings-guardrails-stat-label">Instances</span>
+                <strong x-text="formatNumber(guardrails.length)"></strong>
+            </div>
+            <div class="settings-guardrails-stat">
+                <span class="settings-guardrails-stat-label">Types</span>
+                <strong x-text="formatNumber(guardrailTypes.length)"></strong>
+            </div>
+        </div>
+    </div>
+
+    {{template "auth-banner" .}}
+
+    <div class="alert alert-warning" x-show="!guardrailsRuntimeEnabled()">
+        Runtime guardrail execution is currently off because <code>GUARDRAILS_ENABLED</code> is disabled. You can still manage definitions here.
+    </div>
+    <div class="alert alert-warning" x-show="!authError && !guardrailsAvailable">
+        Guardrails feature is unavailable.
+    </div>
+    <div class="alert alert-warning" x-show="!authError && guardrailError" x-text="guardrailError"></div>
+    <div class="alert alert-success" x-show="!authError && guardrailNotice && !guardrailError" x-text="guardrailNotice"></div>
+
+    <div class="settings-guardrails-layout" :class="{ 'is-editor-open': guardrailFormOpen }">
+        <section class="settings-panel settings-guardrails-list">
+            <div class="aliases-editor-header">
+                <div>
+                    <h3>Instances</h3>
+                    <p class="alias-form-hint">Each instance has a reusable name, a type, an optional user path for future UI visibility scoping, and a JSON-backed config payload for that type.</p>
+                </div>
+                <button type="button" class="pagination-btn pagination-btn-primary" :disabled="guardrailTypesLoading || guardrailFormSubmitting || !guardrailsAvailable" @click="openGuardrailCreate()">Create Guardrail</button>
+            </div>
+
+            <div class="table-toolbar" x-show="guardrailsAvailable">
+                <div class="table-toolbar-main">
+                    <input type="text" id="guardrail-filter" class="filter-input" placeholder="Filter by name, type, user path, summary..." aria-label="Guardrail filter" x-model="guardrailFilter">
+                </div>
+            </div>
+
+            <div class="table-wrapper" x-show="filteredGuardrails.length > 0">
+                <table class="data-table settings-guardrails-table">
+                    <thead>
+                        <tr>
+                            <th>Name</th>
+                            <th>Type</th>
+                            <th>User Path</th>
+                            <th>Summary</th>
+                            <th class="col-actions">Actions</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <template x-for="guardrail in filteredGuardrails" :key="guardrail.name">
+                            <tr>
+                                <td class="mono" x-text="guardrail.name"></td>
+                                <td><span class="settings-guardrail-type-pill" x-text="guardrailTypeLabel(guardrail.type)"></span></td>
+                                <td class="mono" x-text="guardrail.user_path || '\u2014'"></td>
+                                <td>
+                                    <div class="settings-guardrail-summary" x-text="guardrail.summary || guardrail.description || 'No summary yet.'"></div>
+                                    <div class="settings-guardrail-description" x-show="guardrail.description" x-text="guardrail.description"></div>
+                                </td>
+                                <td class="col-actions">
+                                    <div class="action-buttons">
+                                        <button type="button" class="table-action-btn" @click="openGuardrailEdit(guardrail)">Edit</button>
+                                        <button type="button" class="table-action-btn danger" :disabled="guardrailDeletingName === guardrail.name" @click="deleteGuardrail(guardrail)">Delete</button>
+                                    </div>
+                                </td>
+                            </tr>
+                        </template>
+                    </tbody>
+                </table>
+            </div>
+
+            <p class="empty-state" x-show="filteredGuardrails.length === 0 && !guardrailsLoading && guardrailsAvailable && !guardrailError && !authError">
+                No guardrails defined yet.
+            </p>
+        </section>
+
+        <aside class="settings-panel settings-guardrails-editor" x-show="guardrailFormOpen">
+            <div class="aliases-editor-header">
+                <div>
+                    <h3 x-text="guardrailFormMode === 'edit' ? 'Edit Guardrail' : 'Create Guardrail'"></h3>
+                    <p class="alias-form-hint">Workflows reference these names directly, so renames are intentionally avoided after creation.</p>
+                </div>
+                <button type="button" class="table-action-btn" @click="closeGuardrailForm()">Close</button>
+            </div>
+
+            <div class="alias-form-grid">
+                <label class="alias-form-field">
+                    <span>Name</span>
+                    <input type="text" class="filter-input" placeholder="safety-system-prompt" x-model="guardrailForm.name" :disabled="guardrailFormMode === 'edit'">
+                </label>
+
+                <label class="alias-form-field">
+                    <span>Type</span>
+                    <select class="usage-log-select settings-select" x-model="guardrailForm.type" :disabled="guardrailFormMode === 'edit'" @change="onGuardrailTypeChange()">
+                        <template x-for="typeDef in guardrailTypes" :key="typeDef.type">
+                            <option :value="typeDef.type" x-text="typeDef.label"></option>
+                        </template>
+                    </select>
+                </label>
+
+                <label class="alias-form-field">
+                    <span>Description</span>
+                    <input type="text" class="filter-input" placeholder="What this guardrail is meant to do" x-model="guardrailForm.description">
+                </label>
+
+                <label class="alias-form-field">
+                    <span>User Path</span>
+                    <input type="text" class="filter-input" placeholder="/team/alpha" x-model="guardrailForm.user_path" aria-label="Guardrail user path">
+                    <small class="alias-form-hint">Reserved for future UI visibility scoping. It does not affect runtime execution yet.</small>
+                </label>
+
+                <template x-for="field in guardrailTypeFields(guardrailForm.type)" :key="field.key">
+                    <label class="alias-form-field alias-form-field-wide">
+                        <span x-text="field.label"></span>
+                        <template x-if="field.input === 'select'">
+                            <select class="usage-log-select settings-select" :value="guardrailFieldValue(field)" @change="setGuardrailFieldValue(field, $event.target.value)">
+                                <template x-for="option in field.options" :key="option.value">
+                                    <option :value="option.value" x-text="option.label"></option>
+                                </template>
+                            </select>
+                        </template>
+                        <template x-if="field.input === 'textarea'">
+                            <textarea class="settings-guardrail-textarea" :placeholder="field.placeholder || ''" :value="guardrailFieldValue(field)" @input="setGuardrailFieldValue(field, $event.target.value)"></textarea>
+                        </template>
+                        <template x-if="field.input !== 'select' && field.input !== 'textarea'">
+                            <input :type="field.input || 'text'" class="filter-input" :placeholder="field.placeholder || ''" :value="guardrailFieldValue(field)" @input="setGuardrailFieldValue(field, $event.target.value)">
+                        </template>
+                        <small class="alias-form-hint" x-show="field.help" x-text="field.help"></small>
+                    </label>
+                </template>
+            </div>
+
+            <div class="alias-form-actions">
+                <button type="button" class="pagination-btn" @click="closeGuardrailForm()">Cancel</button>
+                <button type="button" class="pagination-btn pagination-btn-primary" :disabled="guardrailFormSubmitting" @click="submitGuardrailForm()">Save Guardrail</button>
+            </div>
+        </aside>
+    </div>
+</div>
+
 <!-- API Keys Page -->
 <div x-show="page==='auth-keys'">
     <div class="page-header">
@@ -958,8 +1121,9 @@ <h4>Guardrail Steps</h4>
                         <button type="button" class="table-action-btn" @click="addExecutionPlanGuardrailStep()">Add Step</button>
                     </div>
 
-                    <div class="alert alert-warning" x-show="guardrailRefs.length === 0">
-                        No named guardrails are currently registered on this deployment. You can still draft a plan, but guardrail-backed creation may be rejected.
+                    <div class="alert alert-warning alert-inline-actions" x-show="guardrailRefs.length === 0">
+                        <span>No named guardrails are currently registered on this deployment. You can still draft a plan, but guardrail-backed creation may be rejected.</span>
+                        <button type="button" class="table-action-btn" @click="navigate('guardrails')">Open Guardrails</button>
                     </div>
 
                     <div class="execution-plan-guardrail-list-editor" x-show="executionPlanForm.guardrails.length > 0">
diff --git a/internal/admin/dashboard/templates/layout.html b/internal/admin/dashboard/templates/layout.html
index a1afc2af..7ea38636 100644
--- a/internal/admin/dashboard/templates/layout.html
+++ b/internal/admin/dashboard/templates/layout.html
@@ -48,6 +48,10 @@ <h1>GOModel</h1>
                     <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 6v6l4 2"/><circle cx="12" cy="12" r="9"/><path d="M9 3h6"/></svg>
                     <span>Audit Logs</span>
                 </a>
+                <a href="/admin/dashboard/guardrails" class="nav-item" :class="{ active: page === 'guardrails' }" title="Guardrails" x-show="guardrailsPageVisible()" @click.prevent="navigate('guardrails')">
+                    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M12 3l8 4v5c0 5-3.5 8.74-8 9-4.5-.26-8-4-8-9V7l8-4z"/><path d="M9.5 12.5l1.75 1.75L14.75 10.5"/></svg>
+                    <span>Guardrails</span>
+                </a>
                 <a href="/admin/dashboard/auth-keys" class="nav-item" :class="{ active: page === 'auth-keys' }" title="API Keys" @click.prevent="navigate('auth-keys')">
                     <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 2l-2 2m-7.61 7.61a5.5 5.5 0 1 1-7.778 7.778 5.5 5.5 0 0 1 7.777-7.777zm0 0L15.5 7.5m0 0l3 3L22 7l-3-3m-3.5 3.5L19 4"/></svg>
                     <span>API Keys</span>
@@ -103,6 +107,7 @@ <h1>GOModel</h1>
     <script src="/admin/static/js/modules/aliases.js"></script>
     <script src="/admin/static/js/modules/execution-plans.js"></script>
     <script src="/admin/static/js/modules/auth-keys.js"></script>
+    <script src="/admin/static/js/modules/guardrails.js"></script>
     <script src="/admin/static/js/modules/conversation-drawer.js"></script>
     <script src="/admin/static/js/modules/contribution-calendar.js"></script>
     <script src="/admin/static/js/modules/charts.js"></script>
diff --git a/internal/admin/handler.go b/internal/admin/handler.go
index fa2d3430..a6e103da 100644
--- a/internal/admin/handler.go
+++ b/internal/admin/handler.go
@@ -3,13 +3,16 @@ package admin
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"log/slog"
 	"net/http"
 	"net/url"
 	"slices"
+	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/labstack/echo/v5"
@@ -32,8 +35,11 @@ type Handler struct {
 	authKeys      *authkeys.Service
 	aliases       *aliases.Service
 	plans         *executionplans.Service
-	guardrails    *guardrails.Registry
+	guardrails    guardrails.Catalog
+	guardrailDefs *guardrails.Service
 	runtimeConfig DashboardConfigResponse
+
+	mutationMu sync.Mutex
 }
 
 // Option configures the admin API handler.
@@ -89,12 +95,20 @@ func WithExecutionPlans(service *executionplans.Service) Option {
 }
 
 // WithGuardrailsRegistry enables listing valid guardrail references for plan authoring.
-func WithGuardrailsRegistry(registry *guardrails.Registry) Option {
+func WithGuardrailsRegistry(registry guardrails.Catalog) Option {
 	return func(h *Handler) {
 		h.guardrails = registry
 	}
 }
 
+// WithGuardrailService enables full guardrail definition administration endpoints.
+func WithGuardrailService(service *guardrails.Service) Option {
+	return func(h *Handler) {
+		h.guardrails = service
+		h.guardrailDefs = service
+	}
+}
+
 // WithDashboardRuntimeConfig enables the allowlisted dashboard runtime config endpoint.
 func WithDashboardRuntimeConfig(values DashboardConfigResponse) Option {
 	return func(h *Handler) {
@@ -694,6 +708,13 @@ type upsertAliasRequest struct {
 	Enabled        *bool  `json:"enabled,omitempty"`
 }
 
+type upsertGuardrailRequest struct {
+	Type        string          `json:"type"`
+	Description string          `json:"description,omitempty"`
+	UserPath    string          `json:"user_path,omitempty"`
+	Config      json.RawMessage `json:"config"`
+}
+
 type createExecutionPlanRequest struct {
 	ScopeProvider string                 `json:"scope_provider,omitempty"`
 	ScopeModel    string                 `json:"scope_model,omitempty"`
@@ -723,6 +744,10 @@ func (h *Handler) authKeysUnavailableError() error {
 	return featureUnavailableError("auth keys feature is unavailable")
 }
 
+func (h *Handler) guardrailsUnavailableError() error {
+	return featureUnavailableError("guardrails feature is unavailable")
+}
+
 func (h *Handler) executionPlansUnavailableError() error {
 	return featureUnavailableError("execution plans feature is unavailable")
 }
@@ -757,6 +782,16 @@ func authKeyWriteError(err error) error {
 	return err
 }
 
+func guardrailWriteError(err error) error {
+	if err == nil {
+		return nil
+	}
+	if guardrails.IsValidationError(err) {
+		return core.NewInvalidRequestError(err.Error(), err)
+	}
+	return err
+}
+
 func deactivateByID(
 	c *echo.Context,
 	unavailableErr error,
@@ -918,6 +953,105 @@ func (h *Handler) DeleteAlias(c *echo.Context) error {
 	return c.NoContent(http.StatusNoContent)
 }
 
+// ListGuardrailTypes handles GET /admin/api/v1/guardrails/types
+func (h *Handler) ListGuardrailTypes(c *echo.Context) error {
+	if h.guardrailDefs == nil {
+		return handleError(c, h.guardrailsUnavailableError())
+	}
+	return c.JSON(http.StatusOK, h.guardrailDefs.TypeDefinitions())
+}
+
+// ListGuardrails handles GET /admin/api/v1/guardrails
+func (h *Handler) ListGuardrails(c *echo.Context) error {
+	if h.guardrailDefs == nil {
+		return handleError(c, h.guardrailsUnavailableError())
+	}
+	views := h.guardrailDefs.ListViews()
+	if views == nil {
+		views = []guardrails.View{}
+	}
+	return c.JSON(http.StatusOK, views)
+}
+
+// UpsertGuardrail handles PUT /admin/api/v1/guardrails/{name}
+func (h *Handler) UpsertGuardrail(c *echo.Context) error {
+	if h.guardrailDefs == nil {
+		return handleError(c, h.guardrailsUnavailableError())
+	}
+
+	name := strings.TrimSpace(c.Param("name"))
+	if name == "" {
+		return handleError(c, core.NewInvalidRequestError("guardrail name is required", nil))
+	}
+
+	var req upsertGuardrailRequest
+	if err := c.Bind(&req); err != nil {
+		return handleError(c, core.NewInvalidRequestError("invalid request body: "+err.Error(), err))
+	}
+
+	userPath, err := normalizeUserPathQueryParam("user_path", req.UserPath)
+	if err != nil {
+		return handleError(c, err)
+	}
+
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+
+	if err := h.guardrailDefs.Upsert(c.Request().Context(), guardrails.Definition{
+		Name:        name,
+		Type:        req.Type,
+		Description: req.Description,
+		UserPath:    userPath,
+		Config:      req.Config,
+	}); err != nil {
+		return handleError(c, guardrailWriteError(err))
+	}
+	if err := h.refreshExecutionPlansAfterGuardrailChange(c.Request().Context()); err != nil {
+		return handleError(c, err)
+	}
+
+	definition, ok := h.guardrailDefs.Get(name)
+	if !ok {
+		return c.NoContent(http.StatusNoContent)
+	}
+	return c.JSON(http.StatusOK, guardrails.ViewFromDefinition(*definition))
+}
+
+// DeleteGuardrail handles DELETE /admin/api/v1/guardrails/{name}
+func (h *Handler) DeleteGuardrail(c *echo.Context) error {
+	if h.guardrailDefs == nil {
+		return handleError(c, h.guardrailsUnavailableError())
+	}
+
+	name := strings.TrimSpace(c.Param("name"))
+	if name == "" {
+		return handleError(c, core.NewInvalidRequestError("guardrail name is required", nil))
+	}
+
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+
+	referencingWorkflows, err := h.activeWorkflowGuardrailReferences(c.Request().Context(), name)
+	if err != nil {
+		return handleError(c, err)
+	}
+	if len(referencingWorkflows) > 0 {
+		return handleError(c, core.NewInvalidRequestError("guardrail is used by active workflows: "+strings.Join(referencingWorkflows, ", "), nil))
+	}
+
+	if err := h.guardrailDefs.Delete(c.Request().Context(), name); err != nil {
+		if errors.Is(err, guardrails.ErrNotFound) {
+			return handleError(c, core.NewNotFoundError("guardrail not found: "+name))
+		}
+		return handleError(c, guardrailWriteError(err))
+	}
+	if err := h.refreshExecutionPlansAfterGuardrailChange(c.Request().Context()); err != nil {
+		return handleError(c, err)
+	}
+
+	return c.NoContent(http.StatusNoContent)
+}
+
 // ListExecutionPlans handles GET /admin/api/v1/execution-plans
 func (h *Handler) ListExecutionPlans(c *echo.Context) error {
 	if h.plans == nil {
@@ -989,6 +1123,9 @@ func (h *Handler) CreateExecutionPlan(c *echo.Context) error {
 		return handleError(c, err)
 	}
 
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+
 	version, err := h.plans.Create(c.Request().Context(), executionplans.CreateInput{
 		Scope: executionplans.Scope{
 			Provider: req.ScopeProvider,
@@ -1011,14 +1148,67 @@ func (h *Handler) CreateExecutionPlan(c *echo.Context) error {
 
 // DeactivateExecutionPlan handles POST /admin/api/v1/execution-plans/:id/deactivate
 func (h *Handler) DeactivateExecutionPlan(c *echo.Context) error {
-	var unavailableErr error
-	var deactivate func(context.Context, string) error
 	if h.plans == nil {
-		unavailableErr = h.executionPlansUnavailableError()
-	} else {
-		deactivate = h.plans.Deactivate
+		return handleError(c, h.executionPlansUnavailableError())
+	}
+
+	id := strings.TrimSpace(c.Param("id"))
+	if id == "" {
+		return handleError(c, core.NewInvalidRequestError("execution plan id is required", nil))
+	}
+
+	h.mutationMu.Lock()
+	defer h.mutationMu.Unlock()
+
+	if err := h.plans.Deactivate(c.Request().Context(), id); err != nil {
+		if errors.Is(err, executionplans.ErrNotFound) {
+			return handleError(c, core.NewNotFoundError("workflow not found: "+id))
+		}
+		return handleError(c, executionPlanWriteError(err))
+	}
+	return c.NoContent(http.StatusNoContent)
+}
+
+func (h *Handler) refreshExecutionPlansAfterGuardrailChange(ctx context.Context) error {
+	if h.plans == nil {
+		return nil
+	}
+	if err := h.plans.Refresh(ctx); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (h *Handler) activeWorkflowGuardrailReferences(ctx context.Context, name string) ([]string, error) {
+	if h.plans == nil {
+		return nil, nil
+	}
+
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return nil, nil
+	}
+
+	views, err := h.plans.ListViews(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	references := make([]string, 0)
+	for _, view := range views {
+		if !view.Payload.Features.Guardrails {
+			continue
+		}
+		for _, step := range view.Payload.Guardrails {
+			if strings.TrimSpace(step.Ref) != name {
+				continue
+			}
+			references = append(references, view.ScopeDisplay)
+			break
+		}
 	}
-	return deactivateByID(c, unavailableErr, "execution plan", executionplans.ErrNotFound, "workflow not found: ", deactivate, executionPlanWriteError)
+	sort.Strings(references)
+	return references, nil
 }
 
 func (h *Handler) validateExecutionPlanGuardrails(payload executionplans.Payload) error {
diff --git a/internal/admin/handler_executionplans_test.go b/internal/admin/handler_executionplans_test.go
index d8b6e4b0..b7586c27 100644
--- a/internal/admin/handler_executionplans_test.go
+++ b/internal/admin/handler_executionplans_test.go
@@ -3,6 +3,8 @@ package admin
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -72,7 +74,10 @@ func (s *executionPlanTestStore) Create(_ context.Context, input executionplans.
 			scopeKey = "provider_model_path:" + input.Scope.Provider + ":" + input.Scope.Model + ":" + input.Scope.UserPath
 		}
 	}
-	planHash := "hash-created"
+	planHash, err := executionPlanTestPlanHash(input.Payload)
+	if err != nil {
+		return nil, err
+	}
 
 	version := executionplans.Version{
 		ID:          "plan-created",
@@ -98,6 +103,22 @@ func (s *executionPlanTestStore) Create(_ context.Context, input executionplans.
 	return &version, nil
 }
 
+func (s *executionPlanTestStore) EnsureManagedDefaultGlobal(ctx context.Context, input executionplans.CreateInput, planHash string) (*executionplans.Version, error) {
+	for _, version := range s.versions {
+		if !version.Active || version.ScopeKey != "global" {
+			continue
+		}
+		if !version.Managed {
+			return nil, nil
+		}
+		if version.Name == input.Name && version.Description == input.Description && version.PlanHash == planHash {
+			return nil, nil
+		}
+		break
+	}
+	return s.Create(ctx, input)
+}
+
 func (s *executionPlanTestStore) Deactivate(_ context.Context, id string) error {
 	for i := range s.versions {
 		if s.versions[i].ID == id && s.versions[i].Active {
@@ -110,6 +131,15 @@ func (s *executionPlanTestStore) Deactivate(_ context.Context, id string) error
 
 func (s *executionPlanTestStore) Close() error { return nil }
 
+func executionPlanTestPlanHash(payload executionplans.Payload) (string, error) {
+	raw, err := json.Marshal(payload)
+	if err != nil {
+		return "", err
+	}
+	sum := sha256.Sum256(raw)
+	return hex.EncodeToString(sum[:]), nil
+}
+
 func newExecutionPlanRegistry(t *testing.T) *guardrails.Registry {
 	t.Helper()
 
diff --git a/internal/admin/handler_guardrails_test.go b/internal/admin/handler_guardrails_test.go
new file mode 100644
index 00000000..c4b798b4
--- /dev/null
+++ b/internal/admin/handler_guardrails_test.go
@@ -0,0 +1,288 @@
+package admin
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/labstack/echo/v5"
+
+	"gomodel/internal/executionplans"
+	"gomodel/internal/guardrails"
+)
+
+type guardrailTestStore struct {
+	definitions map[string]guardrails.Definition
+}
+
+func newGuardrailTestStore(definitions ...guardrails.Definition) *guardrailTestStore {
+	store := &guardrailTestStore{definitions: make(map[string]guardrails.Definition, len(definitions))}
+	for _, definition := range definitions {
+		store.definitions[definition.Name] = definition
+	}
+	return store
+}
+
+func (s *guardrailTestStore) List(context.Context) ([]guardrails.Definition, error) {
+	result := make([]guardrails.Definition, 0, len(s.definitions))
+	for _, definition := range s.definitions {
+		result = append(result, definition)
+	}
+	return result, nil
+}
+
+func (s *guardrailTestStore) Get(_ context.Context, name string) (*guardrails.Definition, error) {
+	definition, ok := s.definitions[name]
+	if !ok {
+		return nil, guardrails.ErrNotFound
+	}
+	copy := definition
+	return &copy, nil
+}
+
+func (s *guardrailTestStore) Upsert(_ context.Context, definition guardrails.Definition) error {
+	s.definitions[definition.Name] = definition
+	return nil
+}
+
+func (s *guardrailTestStore) UpsertMany(_ context.Context, definitions []guardrails.Definition) error {
+	for _, definition := range definitions {
+		s.definitions[definition.Name] = definition
+	}
+	return nil
+}
+
+func (s *guardrailTestStore) Delete(_ context.Context, name string) error {
+	if _, ok := s.definitions[name]; !ok {
+		return guardrails.ErrNotFound
+	}
+	delete(s.definitions, name)
+	return nil
+}
+
+func (s *guardrailTestStore) Close() error { return nil }
+
+func rawGuardrailConfig(t *testing.T, value any) json.RawMessage {
+	t.Helper()
+	raw, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return raw
+}
+
+func newGuardrailService(t *testing.T, definitions ...guardrails.Definition) *guardrails.Service {
+	t.Helper()
+
+	service, err := guardrails.NewService(newGuardrailTestStore(definitions...))
+	if err != nil {
+		t.Fatalf("guardrails.NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("guardrails.Refresh() error = %v", err)
+	}
+	return service
+}
+
+func newGuardrailHandler(t *testing.T, definitions ...guardrails.Definition) *Handler {
+	t.Helper()
+	return NewHandler(nil, nil, WithGuardrailService(newGuardrailService(t, definitions...)))
+}
+
+func TestListGuardrails(t *testing.T) {
+	h := newGuardrailHandler(t, guardrails.Definition{
+		Name: "policy-system",
+		Type: "system_prompt",
+		Config: rawGuardrailConfig(t, map[string]any{
+			"mode":    "inject",
+			"content": "be precise",
+		}),
+	})
+
+	c, rec := newHandlerContext("/admin/api/v1/guardrails")
+	if err := h.ListGuardrails(c); err != nil {
+		t.Fatalf("ListGuardrails() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+
+	var body []guardrails.View
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("json.Unmarshal() error = %v", err)
+	}
+	if len(body) != 1 || body[0].Name != "policy-system" {
+		t.Fatalf("body = %#v, want one policy-system guardrail", body)
+	}
+	if body[0].Summary == "" {
+		t.Fatal("Summary = empty, want populated summary")
+	}
+}
+
+func TestListGuardrailTypes(t *testing.T) {
+	h := newGuardrailHandler(t)
+	c, rec := newHandlerContext("/admin/api/v1/guardrails/types")
+
+	if err := h.ListGuardrailTypes(c); err != nil {
+		t.Fatalf("ListGuardrailTypes() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+
+	var body []guardrails.TypeDefinition
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatalf("json.Unmarshal() error = %v", err)
+	}
+	if len(body) == 0 || body[0].Type != "system_prompt" {
+		t.Fatalf("body = %#v, want system_prompt type definition", body)
+	}
+}
+
+func TestUpsertGuardrail(t *testing.T) {
+	h := newGuardrailHandler(t)
+	e := echo.New()
+
+	req := httptest.NewRequest(http.MethodPut, "/admin/api/v1/guardrails/policy-system", bytes.NewBufferString(`{
+		"type":"system_prompt",
+		"description":"Default policy",
+		"user_path":"team/alpha",
+		"config":{"mode":"override","content":"Respond carefully."}
+	}`))
+	req.Header.Set("Content-Type", "application/json")
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetPath("/admin/api/v1/guardrails/:name")
+	c.SetPathValues(echo.PathValues{{Name: "name", Value: "policy-system"}})
+
+	if err := h.UpsertGuardrail(c); err != nil {
+		t.Fatalf("UpsertGuardrail() error = %v", err)
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+
+	guardrail, ok := h.guardrailDefs.Get("policy-system")
+	if !ok || guardrail == nil {
+		t.Fatal("Get(policy-system) = missing, want saved guardrail")
+	}
+	if guardrail.Type != "system_prompt" {
+		t.Fatalf("guardrail.Type = %q, want system_prompt", guardrail.Type)
+	}
+	if guardrail.UserPath != "/team/alpha" {
+		t.Fatalf("guardrail.UserPath = %q, want /team/alpha", guardrail.UserPath)
+	}
+}
+
+func TestDeleteGuardrailRejectsActiveWorkflowReference(t *testing.T) {
+	guardrailService := newGuardrailService(t, guardrails.Definition{
+		Name: "policy-system",
+		Type: "system_prompt",
+		Config: rawGuardrailConfig(t, map[string]any{
+			"mode":    "inject",
+			"content": "be precise",
+		}),
+	})
+	planStore := &executionPlanTestStore{
+		versions: []executionplans.Version{
+			{
+				ID:       "global-plan",
+				Scope:    executionplans.Scope{},
+				ScopeKey: "global",
+				Version:  1,
+				Active:   true,
+				Name:     "global",
+				Payload: executionplans.Payload{
+					SchemaVersion: 1,
+					Features:      executionplans.FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: true},
+					Guardrails:    []executionplans.GuardrailStep{{Ref: "policy-system", Step: 10}},
+				},
+				PlanHash: "hash-global",
+			},
+		},
+	}
+	planService, err := executionplans.NewService(planStore, executionplans.NewCompiler(guardrailService))
+	if err != nil {
+		t.Fatalf("executionplans.NewService() error = %v", err)
+	}
+	if err := planService.Refresh(context.Background()); err != nil {
+		t.Fatalf("planService.Refresh() error = %v", err)
+	}
+
+	h := NewHandler(nil, nil, WithGuardrailService(guardrailService), WithExecutionPlans(planService))
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodDelete, "/admin/api/v1/guardrails/policy-system", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetPath("/admin/api/v1/guardrails/:name")
+	c.SetPathValues(echo.PathValues{{Name: "name", Value: "policy-system"}})
+
+	if err := h.DeleteGuardrail(c); err != nil {
+		t.Fatalf("DeleteGuardrail() error = %v", err)
+	}
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+
+	envelope := decodeExecutionPlanErrorEnvelope(t, rec.Body.Bytes())
+	if envelope.Error.Message != "guardrail is used by active workflows: global" {
+		t.Fatalf("error message = %q, want active workflow reference", envelope.Error.Message)
+	}
+}
+
+func TestDeleteGuardrailIgnoresDisabledWorkflowGuardrailRefs(t *testing.T) {
+	guardrailService := newGuardrailService(t, guardrails.Definition{
+		Name: "policy-system",
+		Type: "system_prompt",
+		Config: rawGuardrailConfig(t, map[string]any{
+			"mode":    "inject",
+			"content": "be precise",
+		}),
+	})
+	planStore := &executionPlanTestStore{
+		versions: []executionplans.Version{
+			{
+				ID:       "global-plan",
+				Scope:    executionplans.Scope{},
+				ScopeKey: "global",
+				Version:  1,
+				Active:   true,
+				Name:     "global",
+				Payload: executionplans.Payload{
+					SchemaVersion: 1,
+					Features:      executionplans.FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+					Guardrails:    []executionplans.GuardrailStep{{Ref: "policy-system", Step: 10}},
+				},
+				PlanHash: "hash-global",
+			},
+		},
+	}
+	planService, err := executionplans.NewService(planStore, executionplans.NewCompiler(guardrailService))
+	if err != nil {
+		t.Fatalf("executionplans.NewService() error = %v", err)
+	}
+	if err := planService.Refresh(context.Background()); err != nil {
+		t.Fatalf("planService.Refresh() error = %v", err)
+	}
+
+	h := NewHandler(nil, nil, WithGuardrailService(guardrailService), WithExecutionPlans(planService))
+	e := echo.New()
+	req := httptest.NewRequest(http.MethodDelete, "/admin/api/v1/guardrails/policy-system", nil)
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+	c.SetPath("/admin/api/v1/guardrails/:name")
+	c.SetPathValues(echo.PathValues{{Name: "name", Value: "policy-system"}})
+
+	if err := h.DeleteGuardrail(c); err != nil {
+		t.Fatalf("DeleteGuardrail() error = %v", err)
+	}
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, want 204", rec.Code)
+	}
+	if _, ok := h.guardrailDefs.Get("policy-system"); ok {
+		t.Fatal("Get(policy-system) = present, want deleted guardrail")
+	}
+}
diff --git a/internal/app/app.go b/internal/app/app.go
index 1e1e51be..09a3c419 100644
--- a/internal/app/app.go
+++ b/internal/app/app.go
@@ -4,6 +4,7 @@ package app
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -40,6 +41,7 @@ type App struct {
 	batch          *batch.Result
 	aliases        *aliases.Result
 	authKeys       *authkeys.Result
+	guardrails     *guardrails.Result
 	executionPlans *executionplans.Result
 	server         *server.Server
 
@@ -166,60 +168,73 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	}
 	app.aliases = aliasResult
 
+	refreshInterval := executionPlanRefreshInterval(appCfg)
+
+	// Initialize reusable guardrail definitions using shared storage when already available.
+	var guardrailResult *guardrails.Result
+	sharedGuardrailStorage := firstSharedStorage(auditResult.Storage, usageResult.Storage, batchResult.Storage, aliasResult.Storage)
+	if sharedGuardrailStorage != nil {
+		guardrailResult, err = guardrails.NewWithSharedStorage(ctx, sharedGuardrailStorage, refreshInterval)
+	} else {
+		guardrailResult, err = guardrails.New(ctx, appCfg, refreshInterval)
+	}
+	if err != nil {
+		closeErr := errors.Join(app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		if closeErr != nil {
+			return nil, fmt.Errorf("failed to initialize guardrails: %w (also: close error: %v)", err, closeErr)
+		}
+		return nil, fmt.Errorf("failed to initialize guardrails: %w", err)
+	}
+	app.guardrails = guardrailResult
+
+	seedGuardrails, err := configGuardrailDefinitions(appCfg.Guardrails)
+	if err != nil {
+		closeErr := errors.Join(app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		if closeErr != nil {
+			return nil, fmt.Errorf("failed to prepare guardrail definitions: %w (also: close error: %v)", err, closeErr)
+		}
+		return nil, fmt.Errorf("failed to prepare guardrail definitions: %w", err)
+	}
+	if err := guardrailResult.Service.UpsertDefinitions(ctx, seedGuardrails); err != nil {
+		closeErr := errors.Join(app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		if closeErr != nil {
+			return nil, fmt.Errorf("failed to upsert guardrails: %w (also: close error: %v)", err, closeErr)
+		}
+		return nil, fmt.Errorf("failed to upsert guardrails: %w", err)
+	}
+
 	// Build runtime execution dependencies. Policy is passed explicitly into the
 	// server; the live provider dependency remains the bare router.
 	var provider core.RoutableProvider = app.providers.Router
 	var translatedRequestPatcher server.TranslatedRequestPatcher
 	var batchRequestPreparers []server.BatchRequestPreparer
 	featureCaps := runtimeExecutionFeatureCaps(appCfg)
-	var guardrailRegistry *guardrails.Registry
-	if featureCaps.Guardrails {
-		guardrailRegistry, err = buildGuardrailRegistry(appCfg.Guardrails)
-		if err != nil {
-			var (
-				aliasCloseErr error
-				batchCloseErr error
-			)
-			if app.aliases != nil {
-				aliasCloseErr = app.aliases.Close()
-			}
-			if app.batch != nil {
-				batchCloseErr = app.batch.Close()
-			}
-			closeErr := errors.Join(aliasCloseErr, batchCloseErr, app.usage.Close(), app.audit.Close(), app.providers.Close())
-			if closeErr != nil {
-				return nil, fmt.Errorf("failed to build guardrails: %w (also: close error: %v)", err, closeErr)
-			}
-			return nil, fmt.Errorf("failed to build guardrails: %w", err)
-		}
-	}
 
 	var executionPlanResult *executionplans.Result
-	sharedExecutionPlanStorage := firstSharedStorage(auditResult.Storage, usageResult.Storage, batchResult.Storage, aliasResult.Storage)
-	executionPlanCompiler := executionplans.NewCompilerWithFeatureCaps(guardrailRegistry, featureCaps)
-	refreshInterval := executionPlanRefreshInterval(appCfg)
+	sharedExecutionPlanStorage := firstSharedStorage(auditResult.Storage, usageResult.Storage, batchResult.Storage, aliasResult.Storage, guardrailResult.Storage)
+	executionPlanCompiler := executionplans.NewCompilerWithFeatureCaps(guardrailResult.Service, featureCaps)
 	if sharedExecutionPlanStorage != nil {
 		executionPlanResult, err = executionplans.NewWithSharedStorage(ctx, sharedExecutionPlanStorage, executionPlanCompiler, refreshInterval)
 	} else {
 		executionPlanResult, err = executionplans.New(ctx, appCfg, executionPlanCompiler, refreshInterval)
 	}
 	if err != nil {
-		closeErr := errors.Join(app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		closeErr := errors.Join(app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
 		if closeErr != nil {
 			return nil, fmt.Errorf("failed to initialize execution plans: %w (also: close error: %v)", err, closeErr)
 		}
 		return nil, fmt.Errorf("failed to initialize execution plans: %w", err)
 	}
-	defaultExecutionPlan := defaultExecutionPlanInput(appCfg)
+	defaultExecutionPlan := defaultExecutionPlanInput(appCfg, guardrailResult.Service.Names(), seedGuardrails)
 	if err := executionPlanResult.Service.EnsureDefaultGlobal(ctx, defaultExecutionPlan); err != nil {
-		closeErr := errors.Join(executionPlanResult.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		closeErr := errors.Join(executionPlanResult.Close(), app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
 		if closeErr != nil {
 			return nil, fmt.Errorf("failed to seed execution plans: %w (also: close error: %v)", err, closeErr)
 		}
 		return nil, fmt.Errorf("failed to seed execution plans: %w", err)
 	}
 	if err := executionPlanResult.Service.Refresh(ctx); err != nil {
-		closeErr := errors.Join(executionPlanResult.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		closeErr := errors.Join(executionPlanResult.Close(), app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
 		if closeErr != nil {
 			return nil, fmt.Errorf("failed to load execution plans: %w (also: close error: %v)", err, closeErr)
 		}
@@ -233,6 +248,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		usageResult.Storage,
 		batchResult.Storage,
 		aliasResult.Storage,
+		guardrailResult.Storage,
 		executionPlanResult.Storage,
 	)
 	if sharedAuthKeyStorage != nil {
@@ -241,7 +257,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		authKeyResult, err = authkeys.New(ctx, appCfg)
 	}
 	if err != nil {
-		closeErr := errors.Join(executionPlanResult.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
+		closeErr := errors.Join(executionPlanResult.Close(), app.guardrails.Close(), app.aliases.Close(), app.batch.Close(), app.usage.Close(), app.audit.Close(), app.providers.Close())
 		if closeErr != nil {
 			return nil, fmt.Errorf("failed to initialize auth keys: %w (also: close error: %v)", err, closeErr)
 		}
@@ -254,14 +270,14 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	app.logStartupInfo()
 
 	if featureCaps.Guardrails {
-		if guardrailRegistry != nil && guardrailRegistry.Len() > 0 {
+		if app.guardrails != nil && app.guardrails.Service != nil && app.guardrails.Service.Len() > 0 {
 			translatedRequestPatcher = guardrails.NewPlannedRequestPatcher(executionPlanResult.Service)
 			if appCfg.Guardrails.EnableForBatchProcessing {
 				batchRequestPreparers = append(batchRequestPreparers, guardrails.NewPlannedBatchPreparer(provider, executionPlanResult.Service))
 			}
 			slog.Info(
 				"guardrails enabled",
-				"count", guardrailRegistry.Len(),
+				"count", app.guardrails.Service.Len(),
 				"enable_for_batch_processing", appCfg.Guardrails.EnableForBatchProcessing,
 			)
 		}
@@ -273,8 +289,6 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	}
 	batchRequestPreparer := server.ComposeBatchRequestPreparers(providerAsNativeFileRouter(provider), batchRequestPreparers...)
 
-	guardrailsHash := computeGuardrailsHashFromConfig(appCfg.Guardrails)
-
 	// Create server
 	allowPassthroughV1Alias := appCfg.Server.AllowPassthroughV1Alias
 	serverCfg := &server.Config{
@@ -291,7 +305,6 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		FallbackResolver:             fallback.NewResolver(appCfg.Fallback, providerResult.Registry),
 		ExecutionPolicyResolver:      executionPlanResult.Service,
 		TranslatedRequestPatcher:     translatedRequestPatcher,
-		GuardrailsHash:               guardrailsHash,
 		BatchRequestPreparer:         batchRequestPreparer,
 		ExposedModelLister:           app.aliases.Service,
 		PassthroughSemanticEnrichers: cfg.Factory.PassthroughSemanticEnrichers(),
@@ -318,7 +331,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 			authKeyResult.Service,
 			app.aliases.Service,
 			executionPlanResult.Service,
-			guardrailRegistry,
+			app.guardrails.Service,
 			dashboardRuntimeConfig(appCfg, usageEnabledForDashboard),
 			adminCfg.UIEnabled,
 		)
@@ -354,6 +367,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 	if err != nil {
 		var (
 			executionPlansCloseErr error
+			guardrailsCloseErr     error
 			authKeysCloseErr       error
 			aliasCloseErr          error
 			batchCloseErr          error
@@ -361,6 +375,9 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		if app.executionPlans != nil {
 			executionPlansCloseErr = app.executionPlans.Close()
 		}
+		if app.guardrails != nil {
+			guardrailsCloseErr = app.guardrails.Close()
+		}
 		if app.authKeys != nil {
 			authKeysCloseErr = app.authKeys.Close()
 		}
@@ -370,7 +387,7 @@ func New(ctx context.Context, cfg Config) (*App, error) {
 		if app.batch != nil {
 			batchCloseErr = app.batch.Close()
 		}
-		closeErr := errors.Join(executionPlansCloseErr, authKeysCloseErr, aliasCloseErr, batchCloseErr, app.usage.Close(), app.audit.Close(), app.providers.Close())
+		closeErr := errors.Join(executionPlansCloseErr, guardrailsCloseErr, authKeysCloseErr, aliasCloseErr, batchCloseErr, app.usage.Close(), app.audit.Close(), app.providers.Close())
 		if closeErr != nil {
 			return nil, fmt.Errorf("failed to initialize response cache: %w (also: close error: %v)", err, closeErr)
 		}
@@ -526,7 +543,15 @@ func (a *App) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	// 5. Close managed auth keys subsystem.
+	// 5. Close reusable guardrails subsystem.
+	if a.guardrails != nil {
+		if err := a.guardrails.Close(); err != nil {
+			slog.Error("guardrails close error", "error", err)
+			errs = append(errs, fmt.Errorf("guardrails close: %w", err))
+		}
+	}
+
+	// 6. Close managed auth keys subsystem.
 	if a.authKeys != nil {
 		if err := a.authKeys.Close(); err != nil {
 			slog.Error("auth keys close error", "error", err)
@@ -534,7 +559,7 @@ func (a *App) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	// 6. Close batch store (flushes pending entries)
+	// 7. Close batch store (flushes pending entries)
 	if a.batch != nil {
 		if err := a.batch.Close(); err != nil {
 			slog.Error("batch store close error", "error", err)
@@ -542,7 +567,7 @@ func (a *App) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	// 7. Close usage tracking (flushes pending entries)
+	// 8. Close usage tracking (flushes pending entries)
 	if a.usage != nil {
 		if err := a.usage.Close(); err != nil {
 			slog.Error("usage logger close error", "error", err)
@@ -550,7 +575,7 @@ func (a *App) Shutdown(ctx context.Context) error {
 		}
 	}
 
-	// 8. Close audit logging (flushes pending logs)
+	// 9. Close audit logging (flushes pending logs)
 	if a.audit != nil {
 		if err := a.audit.Close(); err != nil {
 			slog.Error("audit logger close error", "error", err)
@@ -627,7 +652,7 @@ func initAdmin(
 	authKeyService *authkeys.Service,
 	aliasService *aliases.Service,
 	executionPlanService *executionplans.Service,
-	guardrailRegistry *guardrails.Registry,
+	guardrailService *guardrails.Service,
 	runtimeConfig admin.DashboardConfigResponse,
 	uiEnabled bool,
 ) (*admin.Handler, *dashboard.Handler, error) {
@@ -667,7 +692,7 @@ func initAdmin(
 		admin.WithAuthKeys(authKeyService),
 		admin.WithAliases(aliasService),
 		admin.WithExecutionPlans(executionPlanService),
-		admin.WithGuardrailsRegistry(guardrailRegistry),
+		admin.WithGuardrailService(guardrailService),
 		admin.WithDashboardRuntimeConfig(runtimeConfig),
 	)
 
@@ -683,99 +708,92 @@ func initAdmin(
 	return adminHandler, dashHandler, nil
 }
 
-func buildGuardrailRegistry(cfg config.GuardrailsConfig) (*guardrails.Registry, error) {
-	registry := guardrails.NewRegistry()
+func configGuardrailDefinitions(cfg config.GuardrailsConfig) ([]guardrails.Definition, error) {
+	if !cfg.Enabled {
+		return nil, nil
+	}
 
+	definitions := make([]guardrails.Definition, 0, len(cfg.Rules))
 	for i, rule := range cfg.Rules {
-		g, err := buildGuardrail(rule)
-		if err != nil {
-			return nil, fmt.Errorf("guardrail rule #%d (%q): %w", i, rule.Name, err)
+		name := strings.TrimSpace(rule.Name)
+		ruleType := strings.ToLower(strings.TrimSpace(rule.Type))
+		if name == "" {
+			return nil, fmt.Errorf("guardrail rule #%d: name is required", i)
 		}
-		if err := registry.Register(g, responsecache.GuardrailRuleDescriptor{
-			Type:    rule.Type,
-			Order:   rule.Order,
-			Mode:    effectiveSystemPromptMode(rule.SystemPrompt.Mode),
-			Content: rule.SystemPrompt.Content,
-		}); err != nil {
-			return nil, fmt.Errorf("register guardrail %q: %w", rule.Name, err)
+		if ruleType == "" {
+			return nil, fmt.Errorf("guardrail rule #%d (%q): type is required", i, name)
 		}
-		slog.Info("guardrail registered", "name", rule.Name, "type", rule.Type, "order", rule.Order)
-	}
 
-	return registry, nil
-}
-
-// buildGuardrail creates a single Guardrail instance from a rule config.
-func buildGuardrail(rule config.GuardrailRuleConfig) (guardrails.Guardrail, error) {
-	if rule.Name == "" {
-		return nil, fmt.Errorf("name is required")
-	}
-
-	switch rule.Type {
-	case "system_prompt":
-		mode := guardrails.SystemPromptMode(effectiveSystemPromptMode(rule.SystemPrompt.Mode))
-		return guardrails.NewSystemPromptGuardrail(rule.Name, mode, rule.SystemPrompt.Content)
-
-	default:
-		return nil, fmt.Errorf("unknown guardrail type: %q", rule.Type)
-	}
-}
-
-// computeGuardrailsHashFromConfig computes a stable hash of all configured guardrail rules.
-// The hash is stored in the Echo context post-patch so the semantic cache can include it
-// in params_hash, ensuring automatic cache invalidation when guardrail policy changes.
-func computeGuardrailsHashFromConfig(cfg config.GuardrailsConfig) string {
-	if !cfg.Enabled || len(cfg.Rules) == 0 {
-		return ""
-	}
-	rules := make([]responsecache.GuardrailRuleDescriptor, len(cfg.Rules))
-	for i, r := range cfg.Rules {
-		rules[i] = responsecache.GuardrailRuleDescriptor{
-			Name:    r.Name,
-			Type:    r.Type,
-			Order:   r.Order,
-			Mode:    effectiveSystemPromptMode(r.SystemPrompt.Mode),
-			Content: r.SystemPrompt.Content,
+		var rawConfig []byte
+		var err error
+		switch ruleType {
+		case "system_prompt":
+			rawConfig, err = json.Marshal(map[string]any{
+				"mode":    rule.SystemPrompt.Mode,
+				"content": rule.SystemPrompt.Content,
+			})
+		default:
+			return nil, fmt.Errorf("guardrail rule #%d (%q): unsupported type %q", i, name, ruleType)
 		}
+		if err != nil {
+			return nil, fmt.Errorf("guardrail rule #%d (%q): marshal config: %w", i, name, err)
+		}
+		definitions = append(definitions, guardrails.Definition{
+			Name:   name,
+			Type:   ruleType,
+			Config: rawConfig,
+		})
 	}
-	return responsecache.ComputeGuardrailsHash(rules)
-}
-
-func effectiveSystemPromptMode(mode string) string {
-	resolved := guardrails.SystemPromptMode(mode)
-	if resolved == "" {
-		return string(guardrails.SystemPromptInject)
-	}
-	return string(resolved)
+	return definitions, nil
 }
 
-func defaultExecutionPlanInput(cfg *config.Config) executionplans.CreateInput {
+func defaultExecutionPlanInput(cfg *config.Config, availableGuardrails []string, configuredGuardrails []guardrails.Definition) executionplans.CreateInput {
 	fallbackEnabled := fallbackFeatureEnabledGlobally(cfg)
 	payload := executionplans.Payload{
 		SchemaVersion: 1,
 		Features: executionplans.FeatureFlags{
-			Cache:      responseCacheConfigured(cfg.Cache.Response),
-			Audit:      cfg.Logging.Enabled,
-			Usage:      cfg.Usage.Enabled,
-			Guardrails: cfg.Guardrails.Enabled && len(cfg.Guardrails.Rules) > 0,
-			Fallback:   &fallbackEnabled,
+			Cache:    responseCacheConfigured(cfg.Cache.Response),
+			Audit:    cfg.Logging.Enabled,
+			Usage:    cfg.Usage.Enabled,
+			Fallback: &fallbackEnabled,
 		},
 	}
-	if payload.Features.Guardrails {
+	available := make(map[string]struct{}, len(availableGuardrails))
+	for _, name := range availableGuardrails {
+		available[strings.TrimSpace(name)] = struct{}{}
+	}
+	for _, definition := range configuredGuardrails {
+		name := strings.TrimSpace(definition.Name)
+		if name == "" {
+			continue
+		}
+		available[name] = struct{}{}
+	}
+	if cfg.Guardrails.Enabled && len(cfg.Guardrails.Rules) > 0 {
 		payload.Guardrails = make([]executionplans.GuardrailStep, 0, len(cfg.Guardrails.Rules))
 		for _, rule := range cfg.Guardrails.Rules {
+			name := strings.TrimSpace(rule.Name)
+			if name == "" {
+				continue
+			}
+			if len(available) > 0 {
+				if _, ok := available[name]; !ok {
+					continue
+				}
+			}
 			payload.Guardrails = append(payload.Guardrails, executionplans.GuardrailStep{
-				Ref:  rule.Name,
+				Ref:  name,
 				Step: rule.Order,
 			})
 		}
 	}
+	payload.Features.Guardrails = len(payload.Guardrails) > 0
 
 	return executionplans.CreateInput{
 		Scope:       executionplans.Scope{},
 		Activate:    true,
-		Name:        "default-global",
-		Description: "Bootstrapped from runtime configuration",
+		Name:        executionplans.ManagedDefaultGlobalName,
+		Description: executionplans.ManagedDefaultGlobalDescription,
 		Payload:     payload,
 	}
 }
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index e5d4ead9..525a7d6f 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -5,6 +5,7 @@ import (
 
 	"gomodel/config"
 	"gomodel/internal/admin"
+	"gomodel/internal/guardrails"
 )
 
 func TestRuntimeExecutionFeatureCaps_EnableFallbackFromOverride(t *testing.T) {
@@ -30,7 +31,7 @@ func TestDefaultExecutionPlanInput_SetsFallbackFeature(t *testing.T) {
 		},
 	}
 
-	input := defaultExecutionPlanInput(cfg)
+	input := defaultExecutionPlanInput(cfg, nil, nil)
 	if input.Payload.Features.Fallback == nil {
 		t.Fatal("defaultExecutionPlanInput().Payload.Features.Fallback = nil, want non-nil")
 	}
@@ -39,6 +40,150 @@ func TestDefaultExecutionPlanInput_SetsFallbackFeature(t *testing.T) {
 	}
 }
 
+func TestDefaultExecutionPlanInput_IncludesConfiguredGuardrailsMissingFromLoadedCatalog(t *testing.T) {
+	cfg := &config.Config{
+		Guardrails: config.GuardrailsConfig{
+			Enabled: true,
+			Rules: []config.GuardrailRuleConfig{
+				{
+					Name:  "policy-system",
+					Type:  "system_prompt",
+					Order: 10,
+				},
+			},
+		},
+	}
+
+	input := defaultExecutionPlanInput(cfg, nil, []guardrails.Definition{
+		{Name: "policy-system", Type: "system_prompt"},
+	})
+
+	if !input.Payload.Features.Guardrails {
+		t.Fatal("defaultExecutionPlanInput().Payload.Features.Guardrails = false, want true")
+	}
+	if len(input.Payload.Guardrails) != 1 {
+		t.Fatalf("len(defaultExecutionPlanInput().Payload.Guardrails) = %d, want 1", len(input.Payload.Guardrails))
+	}
+	if got := input.Payload.Guardrails[0].Ref; got != "policy-system" {
+		t.Fatalf("defaultExecutionPlanInput().Payload.Guardrails[0].Ref = %q, want policy-system", got)
+	}
+}
+
+func TestDefaultExecutionPlanInput_TrimsConfiguredGuardrailRefs(t *testing.T) {
+	cfg := &config.Config{
+		Guardrails: config.GuardrailsConfig{
+			Enabled: true,
+			Rules: []config.GuardrailRuleConfig{
+				{
+					Name:  "  policy-system  ",
+					Type:  "system_prompt",
+					Order: 10,
+				},
+			},
+		},
+	}
+
+	input := defaultExecutionPlanInput(cfg, []string{"policy-system"}, nil)
+	if len(input.Payload.Guardrails) != 1 {
+		t.Fatalf("len(defaultExecutionPlanInput().Payload.Guardrails) = %d, want 1", len(input.Payload.Guardrails))
+	}
+	if got := input.Payload.Guardrails[0].Ref; got != "policy-system" {
+		t.Fatalf("defaultExecutionPlanInput().Payload.Guardrails[0].Ref = %q, want policy-system", got)
+	}
+}
+
+func TestConfigGuardrailDefinitions_DisabledIgnoresInvalidRules(t *testing.T) {
+	definitions, err := configGuardrailDefinitions(config.GuardrailsConfig{
+		Enabled: false,
+		Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "draft-rule",
+				Type: "future_guardrail_type",
+				SystemPrompt: config.SystemPromptSettings{
+					Content: "",
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("configGuardrailDefinitions() error = %v, want nil", err)
+	}
+	if len(definitions) != 0 {
+		t.Fatalf("len(configGuardrailDefinitions()) = %d, want 0", len(definitions))
+	}
+}
+
+func TestConfigGuardrailDefinitions_EnabledRejectsUnknownType(t *testing.T) {
+	_, err := configGuardrailDefinitions(config.GuardrailsConfig{
+		Enabled: true,
+		Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "draft-rule",
+				Type: "future_guardrail_type",
+			},
+		},
+	})
+	if err == nil {
+		t.Fatal("configGuardrailDefinitions() error = nil, want unsupported type error")
+	}
+}
+
+func TestConfigGuardrailDefinitions_TrimAndCanonicalizeRuleIdentity(t *testing.T) {
+	definitions, err := configGuardrailDefinitions(config.GuardrailsConfig{
+		Enabled: true,
+		Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "  policy-system  ",
+				Type: "  SYSTEM_PROMPT  ",
+				SystemPrompt: config.SystemPromptSettings{
+					Mode:    "inject",
+					Content: "be precise",
+				},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("configGuardrailDefinitions() error = %v", err)
+	}
+	if len(definitions) != 1 {
+		t.Fatalf("len(configGuardrailDefinitions()) = %d, want 1", len(definitions))
+	}
+	if definitions[0].Name != "policy-system" {
+		t.Fatalf("definitions[0].Name = %q, want policy-system", definitions[0].Name)
+	}
+	if definitions[0].Type != "system_prompt" {
+		t.Fatalf("definitions[0].Type = %q, want system_prompt", definitions[0].Type)
+	}
+}
+
+func TestConfigGuardrailDefinitions_RejectsBlankNameOrType(t *testing.T) {
+	_, err := configGuardrailDefinitions(config.GuardrailsConfig{
+		Enabled: true,
+		Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "   ",
+				Type: "system_prompt",
+			},
+		},
+	})
+	if err == nil {
+		t.Fatal("configGuardrailDefinitions() error = nil, want name validation error")
+	}
+
+	_, err = configGuardrailDefinitions(config.GuardrailsConfig{
+		Enabled: true,
+		Rules: []config.GuardrailRuleConfig{
+			{
+				Name: "policy-system",
+				Type: "   ",
+			},
+		},
+	})
+	if err == nil {
+		t.Fatal("configGuardrailDefinitions() error = nil, want type validation error")
+	}
+}
+
 func TestDashboardRuntimeConfig_ExposesFallbackMode(t *testing.T) {
 	cfg := &config.Config{
 		Fallback: config.FallbackConfig{
diff --git a/internal/executionplans/compiler.go b/internal/executionplans/compiler.go
index 468d68ca..4a0a03e2 100644
--- a/internal/executionplans/compiler.go
+++ b/internal/executionplans/compiler.go
@@ -1,25 +1,26 @@
 package executionplans
 
 import (
-	"fmt"
+	"errors"
+	"net/http"
 
 	"gomodel/internal/core"
 	"gomodel/internal/guardrails"
 )
 
 type compiler struct {
-	registry    *guardrails.Registry
+	registry    guardrails.Catalog
 	featureCaps core.ExecutionFeatures
 }
 
 // NewCompiler creates the default execution-plan compiler for the v1 payload.
-func NewCompiler(registry *guardrails.Registry) Compiler {
+func NewCompiler(registry guardrails.Catalog) Compiler {
 	return NewCompilerWithFeatureCaps(registry, core.DefaultExecutionFeatures())
 }
 
 // NewCompilerWithFeatureCaps creates the default execution-plan compiler for the
 // v1 payload with process-level feature caps applied at compile time.
-func NewCompilerWithFeatureCaps(registry *guardrails.Registry, featureCaps core.ExecutionFeatures) Compiler {
+func NewCompilerWithFeatureCaps(registry guardrails.Catalog, featureCaps core.ExecutionFeatures) Compiler {
 	return &compiler{
 		registry:    registry,
 		featureCaps: featureCaps,
@@ -69,7 +70,17 @@ func (c *compiler) compileGuardrails(steps []guardrails.StepReference) (*guardra
 		return nil, "", nil
 	}
 	if c == nil || c.registry == nil {
-		return nil, "", fmt.Errorf("guardrails are enabled but no guardrail registry is configured")
+		return nil, "", core.NewProviderError("", http.StatusBadGateway, "guardrails are enabled but no guardrail registry is configured", nil)
 	}
-	return c.registry.BuildPipeline(steps)
+	if c.registry.Len() == 0 {
+		return nil, "", core.NewProviderError("", http.StatusBadGateway, "guardrails are enabled but no guardrails are loaded", nil)
+	}
+	pipeline, hash, err := c.registry.BuildPipeline(steps)
+	if err == nil {
+		return pipeline, hash, nil
+	}
+	if gatewayErr, ok := errors.AsType[*core.GatewayError](err); ok {
+		return nil, "", gatewayErr
+	}
+	return nil, "", core.NewProviderError("", http.StatusBadGateway, "compile guardrails: "+err.Error(), err)
 }
diff --git a/internal/executionplans/compiler_test.go b/internal/executionplans/compiler_test.go
index 63054a68..2aee948e 100644
--- a/internal/executionplans/compiler_test.go
+++ b/internal/executionplans/compiler_test.go
@@ -1,6 +1,7 @@
 package executionplans
 
 import (
+	"errors"
 	"testing"
 
 	"gomodel/internal/core"
@@ -131,3 +132,62 @@ func TestCompilerCompile_DefaultsFallbackEnabledWhenUnset(t *testing.T) {
 		t.Fatal("Policy.Features.Fallback = false, want true")
 	}
 }
+
+func TestCompilerCompile_ReturnsGatewayErrorWhenGuardrailsCatalogIsEmpty(t *testing.T) {
+	_, err := NewCompiler(guardrails.NewRegistry()).Compile(Version{
+		ID:      "plan-1",
+		Scope:   Scope{},
+		Version: 1,
+		Name:    "global",
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: true},
+			Guardrails: []GuardrailStep{
+				{Ref: "policy-system", Step: 10},
+			},
+		},
+	})
+	if err == nil {
+		t.Fatal("Compile() error = nil, want gateway error")
+	}
+	var gatewayErr *core.GatewayError
+	if !errors.As(err, &gatewayErr) {
+		t.Fatalf("Compile() error = %T, want *core.GatewayError", err)
+	}
+}
+
+func TestCompilerCompile_WrapsBuildPipelineErrorsAsGatewayErrors(t *testing.T) {
+	registry := guardrails.NewRegistry()
+	rule, err := guardrails.NewSystemPromptGuardrail("present", guardrails.SystemPromptInject, "be precise")
+	if err != nil {
+		t.Fatalf("NewSystemPromptGuardrail() error = %v", err)
+	}
+	if err := registry.Register(rule, responsecache.GuardrailRuleDescriptor{
+		Name:    "present",
+		Type:    "system_prompt",
+		Mode:    string(guardrails.SystemPromptInject),
+		Content: "be precise",
+	}); err != nil {
+		t.Fatalf("Register() error = %v", err)
+	}
+	_, err = NewCompiler(registry).Compile(Version{
+		ID:      "plan-1",
+		Scope:   Scope{},
+		Version: 1,
+		Name:    "global",
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: true},
+			Guardrails: []GuardrailStep{
+				{Ref: "missing", Step: 10},
+			},
+		},
+	})
+	if err == nil {
+		t.Fatal("Compile() error = nil, want gateway error")
+	}
+	var gatewayErr *core.GatewayError
+	if !errors.As(err, &gatewayErr) {
+		t.Fatalf("Compile() error = %T, want *core.GatewayError", err)
+	}
+}
diff --git a/internal/executionplans/service.go b/internal/executionplans/service.go
index bfeae072..78f3c313 100644
--- a/internal/executionplans/service.go
+++ b/internal/executionplans/service.go
@@ -15,6 +15,11 @@ import (
 	"gomodel/internal/guardrails"
 )
 
+const (
+	ManagedDefaultGlobalName        = "default-global"
+	ManagedDefaultGlobalDescription = "Bootstrapped from runtime configuration"
+)
+
 // CompiledPlan is the immutable runtime projection cached in the hot-path snapshot.
 type CompiledPlan struct {
 	Version  Version
@@ -171,9 +176,10 @@ func (s *Service) refreshLocked(ctx context.Context) error {
 	return nil
 }
 
-// EnsureDefaultGlobal seeds one active global execution plan when none exists.
+// EnsureDefaultGlobal seeds or reconciles the managed active global execution plan.
 func (s *Service) EnsureDefaultGlobal(ctx context.Context, input CreateInput) error {
-	normalized, _, _, err := normalizeCreateInput(input)
+	input.Managed = true
+	normalized, _, planHash, err := normalizeCreateInput(input)
 	if err != nil {
 		return err
 	}
@@ -181,26 +187,31 @@ func (s *Service) EnsureDefaultGlobal(ctx context.Context, input CreateInput) er
 		return newValidationError("default execution plan must use global scope", nil)
 	}
 
-	versions, err := s.store.ListActive(ctx)
-	if err != nil {
-		return fmt.Errorf("list active execution plans: %w", err)
+	if !normalized.Activate {
+		normalized.Activate = true
 	}
-	for _, version := range versions {
-		scope, _, err := normalizeScope(version.Scope)
-		if err != nil {
-			return fmt.Errorf("load execution plan %q: %w", version.ID, err)
-		}
-		if scope.Provider == "" && scope.Model == "" && scope.UserPath == "" {
-			return nil
-		}
+	normalized.Managed = true
+	previewCompiled, err := s.validateCreateCandidate(normalized, "global", planHash)
+	if err != nil {
+		return err
 	}
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
 
-	if !normalized.Activate {
-		normalized.Activate = true
+	version, err := s.store.EnsureManagedDefaultGlobal(ctx, normalized, planHash)
+	if err != nil {
+		return fmt.Errorf("ensure default global execution plan: %w", err)
 	}
-	if _, err := s.store.Create(ctx, normalized); err != nil {
-		return fmt.Errorf("seed default global execution plan: %w", err)
+	if version == nil {
+		if s.snapshot().global == nil {
+			if err := s.refreshLocked(ctx); err != nil {
+				return err
+			}
+		}
+		return nil
 	}
+
+	s.storeActivatedCompiledLocked(compiledPlanForVersion(previewCompiled, *version))
 	return nil
 }
 
diff --git a/internal/executionplans/service_test.go b/internal/executionplans/service_test.go
index cdc45103..f14db406 100644
--- a/internal/executionplans/service_test.go
+++ b/internal/executionplans/service_test.go
@@ -51,6 +51,7 @@ func (s *staticStore) Create(_ context.Context, input CreateInput) (*Version, er
 		ScopeKey:    scopeKey,
 		Version:     1,
 		Active:      input.Activate,
+		Managed:     input.Managed,
 		Name:        input.Name,
 		Description: input.Description,
 		Payload:     input.Payload,
@@ -59,6 +60,23 @@ func (s *staticStore) Create(_ context.Context, input CreateInput) (*Version, er
 	s.versions = append(s.versions, version)
 	return &version, nil
 }
+
+func (s *staticStore) EnsureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	for _, version := range s.versions {
+		if !version.Active || version.ScopeKey != "global" {
+			continue
+		}
+		if !version.Managed {
+			return nil, nil
+		}
+		if version.Name == input.Name && version.Description == input.Description && version.PlanHash == planHash {
+			return nil, nil
+		}
+		break
+	}
+	return s.Create(ctx, input)
+}
+
 func (s *staticStore) Deactivate(_ context.Context, id string) error {
 	for i := range s.versions {
 		if s.versions[i].ID == id && s.versions[i].Active {
@@ -106,6 +124,10 @@ func (s *concurrentStore) Create(_ context.Context, input CreateInput) (*Version
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	return s.createLocked(input)
+}
+
+func (s *concurrentStore) createLocked(input CreateInput) (*Version, error) {
 	input, scopeKey, planHash, err := normalizeCreateInput(input)
 	if err != nil {
 		return nil, err
@@ -123,6 +145,7 @@ func (s *concurrentStore) Create(_ context.Context, input CreateInput) (*Version
 		ScopeKey:    scopeKey,
 		Version:     len(s.versions) + 1,
 		Active:      input.Activate,
+		Managed:     input.Managed,
 		Name:        input.Name,
 		Description: input.Description,
 		Payload:     input.Payload,
@@ -138,6 +161,25 @@ func (s *concurrentStore) Create(_ context.Context, input CreateInput) (*Version
 	return &version, nil
 }
 
+func (s *concurrentStore) EnsureManagedDefaultGlobal(_ context.Context, input CreateInput, planHash string) (*Version, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for _, version := range s.versions {
+		if !version.Active || version.ScopeKey != "global" {
+			continue
+		}
+		if !version.Managed {
+			return nil, nil
+		}
+		if version.Name == input.Name && version.Description == input.Description && version.PlanHash == planHash {
+			return nil, nil
+		}
+		break
+	}
+	return s.createLocked(input)
+}
+
 func (s *concurrentStore) Deactivate(_ context.Context, id string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -370,6 +412,206 @@ func TestServiceEnsureDefaultGlobal_CreatesWhenMissing(t *testing.T) {
 	if got := store.versions[0].ScopeKey; got != "global" {
 		t.Fatalf("ScopeKey = %q, want global", got)
 	}
+	if !store.versions[0].Managed {
+		t.Fatal("Managed = false, want true for managed default global")
+	}
+	policy, err := service.Match(core.NewExecutionPlanSelector("openai", "gpt-5"))
+	if err != nil {
+		t.Fatalf("Match() error = %v", err)
+	}
+	if policy == nil {
+		t.Fatal("Match() returned nil policy")
+	}
+	if policy.VersionID != store.versions[0].ID {
+		t.Fatalf("Match().VersionID = %q, want %q", policy.VersionID, store.versions[0].ID)
+	}
+}
+
+func TestServiceEnsureDefaultGlobal_ReconcilesManagedDefault(t *testing.T) {
+	store := &staticStore{
+		versions: []Version{
+			{
+				ID:          "global-v1",
+				Scope:       Scope{},
+				ScopeKey:    "global",
+				Version:     1,
+				Active:      true,
+				Managed:     true,
+				Name:        ManagedDefaultGlobalName,
+				Description: ManagedDefaultGlobalDescription,
+				Payload: Payload{
+					SchemaVersion: 1,
+					Features:      FeatureFlags{Cache: false, Audit: true, Usage: true, Guardrails: false},
+				},
+				PlanHash: "stale-hash",
+			},
+		},
+	}
+	service, err := NewService(store, NewCompiler(nil))
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh() error = %v", err)
+	}
+
+	err = service.EnsureDefaultGlobal(context.Background(), CreateInput{
+		Activate:    true,
+		Name:        ManagedDefaultGlobalName,
+		Description: ManagedDefaultGlobalDescription,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err != nil {
+		t.Fatalf("EnsureDefaultGlobal() error = %v", err)
+	}
+	if len(store.versions) != 2 {
+		t.Fatalf("len(store.versions) = %d, want 2", len(store.versions))
+	}
+	if store.versions[0].Active {
+		t.Fatal("store.versions[0].Active = true, want old managed default deactivated")
+	}
+	if !store.versions[1].Active {
+		t.Fatal("store.versions[1].Active = false, want updated managed default active")
+	}
+	if !store.versions[1].Managed {
+		t.Fatal("store.versions[1].Managed = false, want updated managed default marker")
+	}
+	if !store.versions[1].Payload.Features.Cache {
+		t.Fatal("store.versions[1].Payload.Features.Cache = false, want updated payload")
+	}
+}
+
+func TestServiceEnsureDefaultGlobal_PreservesCustomGlobal(t *testing.T) {
+	store := &staticStore{
+		versions: []Version{
+			{
+				ID:          "global-v1",
+				Scope:       Scope{},
+				ScopeKey:    "global",
+				Version:     1,
+				Active:      true,
+				Name:        "custom-global",
+				Description: "User managed",
+				Payload: Payload{
+					SchemaVersion: 1,
+					Features:      FeatureFlags{Cache: false, Audit: true, Usage: true, Guardrails: false},
+				},
+				PlanHash: "custom-hash",
+			},
+		},
+	}
+	service, err := NewService(store, NewCompiler(nil))
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh() error = %v", err)
+	}
+
+	err = service.EnsureDefaultGlobal(context.Background(), CreateInput{
+		Activate:    true,
+		Name:        ManagedDefaultGlobalName,
+		Description: ManagedDefaultGlobalDescription,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err != nil {
+		t.Fatalf("EnsureDefaultGlobal() error = %v", err)
+	}
+	if len(store.versions) != 1 {
+		t.Fatalf("len(store.versions) = %d, want 1", len(store.versions))
+	}
+	if store.versions[0].Name != "custom-global" || !store.versions[0].Active {
+		t.Fatalf("store.versions[0] = %#v, want unchanged active custom global", store.versions[0])
+	}
+}
+
+func TestServiceEnsureDefaultGlobal_LoadsPreservedCustomGlobalIntoSnapshot(t *testing.T) {
+	store := &staticStore{
+		versions: []Version{
+			{
+				ID:          "global-v1",
+				Scope:       Scope{},
+				ScopeKey:    "global",
+				Version:     1,
+				Active:      true,
+				Name:        "custom-global",
+				Description: "User managed",
+				Payload: Payload{
+					SchemaVersion: 1,
+					Features:      FeatureFlags{Cache: false, Audit: true, Usage: true, Guardrails: false},
+				},
+				PlanHash: "custom-hash",
+			},
+		},
+	}
+	service, err := NewService(store, NewCompiler(nil))
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+
+	err = service.EnsureDefaultGlobal(context.Background(), CreateInput{
+		Activate:    true,
+		Name:        ManagedDefaultGlobalName,
+		Description: ManagedDefaultGlobalDescription,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err != nil {
+		t.Fatalf("EnsureDefaultGlobal() error = %v", err)
+	}
+
+	policy, err := service.Match(core.NewExecutionPlanSelector("openai", "gpt-5"))
+	if err != nil {
+		t.Fatalf("Match() error = %v", err)
+	}
+	if policy == nil {
+		t.Fatal("Match() returned nil policy")
+	}
+	if policy.VersionID != "global-v1" {
+		t.Fatalf("Match().VersionID = %q, want global-v1", policy.VersionID)
+	}
+}
+
+func TestServiceEnsureDefaultGlobal_ValidatesBeforeStoreMutation(t *testing.T) {
+	store := &concurrentStore{
+		createCalled: make(chan struct{}, 1),
+	}
+	service, err := NewService(store, &previewEmptyCompiler{delegate: NewCompiler(nil)})
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+
+	err = service.EnsureDefaultGlobal(context.Background(), CreateInput{
+		Activate:    true,
+		Name:        ManagedDefaultGlobalName,
+		Description: ManagedDefaultGlobalDescription,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err == nil {
+		t.Fatal("EnsureDefaultGlobal() error = nil, want validation error")
+	}
+	if !IsValidationError(err) {
+		t.Fatalf("EnsureDefaultGlobal() error = %v, want validation error", err)
+	}
+	if len(store.versions) != 0 {
+		t.Fatalf("len(store.versions) = %d, want 0", len(store.versions))
+	}
+	select {
+	case <-store.createCalled:
+		t.Fatal("EnsureDefaultGlobal() mutated store before validation")
+	default:
+	}
 }
 
 func TestServiceCreate_RefreshesSnapshot(t *testing.T) {
diff --git a/internal/executionplans/store.go b/internal/executionplans/store.go
index 68f5f9e2..9e4acfdc 100644
--- a/internal/executionplans/store.go
+++ b/internal/executionplans/store.go
@@ -43,6 +43,7 @@ type Store interface {
 	ListActive(ctx context.Context) ([]Version, error)
 	Get(ctx context.Context, id string) (*Version, error)
 	Create(ctx context.Context, input CreateInput) (*Version, error)
+	EnsureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error)
 	Deactivate(ctx context.Context, id string) error
 	Close() error
 }
diff --git a/internal/executionplans/store_mongodb.go b/internal/executionplans/store_mongodb.go
index 72cb342d..a7e7130b 100644
--- a/internal/executionplans/store_mongodb.go
+++ b/internal/executionplans/store_mongodb.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -20,6 +21,7 @@ type mongoVersionDocument struct {
 	ScopeKey      string    `bson:"scope_key"`
 	Version       int       `bson:"version"`
 	Active        bool      `bson:"active"`
+	Managed       bool      `bson:"managed_default,omitempty"`
 	Name          string    `bson:"name"`
 	Description   string    `bson:"description,omitempty"`
 	PlanPayload   Payload   `bson:"plan_payload"`
@@ -58,6 +60,17 @@ func NewMongoDBStore(database *mongo.Database) (*MongoDBStore, error) {
 	if _, err := collection.Indexes().CreateMany(ctx, indexes); err != nil {
 		return nil, fmt.Errorf("create execution plan indexes: %w", err)
 	}
+	if _, err := collection.UpdateMany(ctx,
+		bson.D{
+			{Key: "managed_default", Value: bson.D{{Key: "$ne", Value: true}}},
+			{Key: "scope_key", Value: "global"},
+			{Key: "name", Value: ManagedDefaultGlobalName},
+			{Key: "description", Value: ManagedDefaultGlobalDescription},
+		},
+		bson.D{{Key: "$set", Value: bson.D{{Key: "managed_default", Value: true}}}},
+	); err != nil {
+		return nil, fmt.Errorf("backfill managed execution plan defaults: %w", err)
+	}
 
 	return &MongoDBStore{collection: collection}, nil
 }
@@ -136,6 +149,7 @@ func (s *MongoDBStore) Create(ctx context.Context, input CreateInput) (*Version,
 			ScopeKey:    scopeKey,
 			Version:     latest.Version + 1,
 			Active:      input.Activate,
+			Managed:     input.Managed,
 			Name:        input.Name,
 			Description: input.Description,
 			Payload:     input.Payload,
@@ -143,20 +157,7 @@ func (s *MongoDBStore) Create(ctx context.Context, input CreateInput) (*Version,
 			CreatedAt:   now,
 		}
 
-		if _, err := s.collection.InsertOne(sessionCtx, mongoVersionDocument{
-			ID:            version.ID,
-			ScopeProvider: version.Scope.Provider,
-			ScopeModel:    version.Scope.Model,
-			ScopeUserPath: version.Scope.UserPath,
-			ScopeKey:      version.ScopeKey,
-			Version:       version.Version,
-			Active:        version.Active,
-			Name:          version.Name,
-			Description:   version.Description,
-			PlanPayload:   version.Payload,
-			PlanHash:      version.PlanHash,
-			CreatedAt:     version.CreatedAt,
-		}); err != nil {
+		if err := s.insertVersion(sessionCtx, version); err != nil {
 			if mongo.IsDuplicateKeyError(err) {
 				return nil, fmt.Errorf("insert execution plan version: duplicate key: %w", err)
 			}
@@ -176,6 +177,21 @@ func (s *MongoDBStore) Create(ctx context.Context, input CreateInput) (*Version,
 	return version, nil
 }
 
+func (s *MongoDBStore) EnsureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	var lastErr error
+	for range 5 {
+		version, err := s.ensureManagedDefaultGlobal(ctx, input, planHash)
+		if err == nil {
+			return version, nil
+		}
+		if !mongo.IsDuplicateKeyError(err) {
+			return nil, err
+		}
+		lastErr = err
+	}
+	return nil, fmt.Errorf("ensure managed default execution plan after concurrent retries: %w", lastErr)
+}
+
 func (s *MongoDBStore) Deactivate(ctx context.Context, id string) error {
 	result, err := s.collection.UpdateOne(ctx,
 		bson.D{{Key: "_id", Value: id}, {Key: "active", Value: true}},
@@ -194,6 +210,116 @@ func (s *MongoDBStore) Close() error {
 	return nil
 }
 
+func (s *MongoDBStore) ensureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	session, err := s.collection.Database().Client().StartSession()
+	if err != nil {
+		return nil, fmt.Errorf("start execution plan session: %w", err)
+	}
+	defer session.EndSession(ctx)
+
+	result, err := session.WithTransaction(ctx, func(sessionCtx context.Context) (any, error) {
+		var activeDoc mongoVersionDocument
+		err := s.collection.FindOne(sessionCtx,
+			bson.D{{Key: "scope_key", Value: "global"}, {Key: "active", Value: true}},
+			options.FindOne().SetSort(bson.D{{Key: "created_at", Value: -1}, {Key: "_id", Value: -1}}),
+		).Decode(&activeDoc)
+		hasActive := true
+		if err != nil {
+			if errors.Is(err, mongo.ErrNoDocuments) {
+				hasActive = false
+			} else {
+				return nil, fmt.Errorf("load active global execution plan: %w", err)
+			}
+		}
+
+		if hasActive {
+			if !activeDoc.Managed {
+				return nil, nil
+			}
+			if strings.TrimSpace(activeDoc.Name) == input.Name &&
+				strings.TrimSpace(activeDoc.Description) == input.Description &&
+				strings.TrimSpace(activeDoc.PlanHash) == planHash {
+				return nil, nil
+			}
+		}
+
+		var latest struct {
+			Version int `bson:"version"`
+		}
+		findOpts := options.FindOne().SetSort(bson.D{{Key: "version", Value: -1}})
+		err = s.collection.FindOne(sessionCtx, bson.D{{Key: "scope_key", Value: "global"}}, findOpts).Decode(&latest)
+		if err != nil && !errors.Is(err, mongo.ErrNoDocuments) {
+			return nil, fmt.Errorf("load latest execution plan version: %w", err)
+		}
+
+		if hasActive {
+			if _, err := s.collection.UpdateOne(sessionCtx,
+				bson.D{{Key: "_id", Value: activeDoc.ID}, {Key: "active", Value: true}},
+				bson.D{{Key: "$set", Value: bson.D{{Key: "active", Value: false}}}},
+			); err != nil {
+				return nil, fmt.Errorf("deactivate current execution plan version: %w", err)
+			}
+		}
+
+		now := time.Now().UTC()
+		version := &Version{
+			ID:          uuid.NewString(),
+			Scope:       input.Scope,
+			ScopeKey:    "global",
+			Version:     latest.Version + 1,
+			Active:      true,
+			Managed:     true,
+			Name:        input.Name,
+			Description: input.Description,
+			Payload:     input.Payload,
+			PlanHash:    planHash,
+			CreatedAt:   now,
+		}
+
+		if err := s.insertVersion(sessionCtx, version); err != nil {
+			if mongo.IsDuplicateKeyError(err) {
+				return nil, fmt.Errorf("insert execution plan version: duplicate key: %w", err)
+			}
+			return nil, fmt.Errorf("insert execution plan version: %w", err)
+		}
+
+		return version, nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	if result == nil {
+		return nil, nil
+	}
+	version, ok := result.(*Version)
+	if !ok {
+		return nil, fmt.Errorf("unexpected execution plan transaction result: %T", result)
+	}
+	return version, nil
+}
+
+func (s *MongoDBStore) insertVersion(ctx context.Context, version *Version) error {
+	if version == nil {
+		return fmt.Errorf("version is required")
+	}
+	_, err := s.collection.InsertOne(ctx, mongoVersionDocument{
+		ID:            version.ID,
+		ScopeProvider: version.Scope.Provider,
+		ScopeModel:    version.Scope.Model,
+		ScopeUserPath: version.Scope.UserPath,
+		ScopeKey:      version.ScopeKey,
+		Version:       version.Version,
+		Active:        version.Active,
+		Managed:       version.Managed,
+		Name:          version.Name,
+		Description:   version.Description,
+		PlanPayload:   version.Payload,
+		PlanHash:      version.PlanHash,
+		CreatedAt:     version.CreatedAt,
+	})
+	return err
+}
+
 func versionFromMongo(doc mongoVersionDocument) Version {
 	return Version{
 		ID: doc.ID,
@@ -205,6 +331,7 @@ func versionFromMongo(doc mongoVersionDocument) Version {
 		ScopeKey:    doc.ScopeKey,
 		Version:     doc.Version,
 		Active:      doc.Active,
+		Managed:     doc.Managed,
 		Name:        doc.Name,
 		Description: doc.Description,
 		Payload:     doc.PlanPayload,
diff --git a/internal/executionplans/store_postgresql.go b/internal/executionplans/store_postgresql.go
index cf63076a..d15f037f 100644
--- a/internal/executionplans/store_postgresql.go
+++ b/internal/executionplans/store_postgresql.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -36,6 +37,7 @@ func NewPostgreSQLStore(ctx context.Context, pool *pgxpool.Pool) (*PostgreSQLSto
 			scope_key TEXT NOT NULL,
 			version INTEGER NOT NULL,
 			active BOOLEAN NOT NULL DEFAULT TRUE,
+			managed_default BOOLEAN NOT NULL DEFAULT FALSE,
 			name TEXT NOT NULL,
 			description TEXT NOT NULL DEFAULT '',
 			plan_payload JSONB NOT NULL,
@@ -50,6 +52,13 @@ func NewPostgreSQLStore(ctx context.Context, pool *pgxpool.Pool) (*PostgreSQLSto
 		`CREATE INDEX IF NOT EXISTS idx_execution_plan_versions_active_created_at
 			ON execution_plan_versions(active, created_at DESC)`,
 		`ALTER TABLE execution_plan_versions ADD COLUMN IF NOT EXISTS scope_user_path TEXT`,
+		`ALTER TABLE execution_plan_versions ADD COLUMN IF NOT EXISTS managed_default BOOLEAN NOT NULL DEFAULT FALSE`,
+		`UPDATE execution_plan_versions
+			SET managed_default = TRUE
+			WHERE managed_default = FALSE
+			  AND scope_key = 'global'
+			  AND name = '` + ManagedDefaultGlobalName + `'
+			  AND description = '` + ManagedDefaultGlobalDescription + `'`,
 	}
 	for _, statement := range statements {
 		if _, err := pool.Exec(ctx, statement); err != nil {
@@ -62,7 +71,7 @@ func NewPostgreSQLStore(ctx context.Context, pool *pgxpool.Pool) (*PostgreSQLSto
 
 func (s *PostgreSQLStore) ListActive(ctx context.Context) ([]Version, error) {
 	rows, err := s.pool.Query(ctx, `
-		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
 		FROM execution_plan_versions
 		WHERE active = TRUE
 		ORDER BY created_at DESC, id DESC
@@ -78,7 +87,7 @@ func (s *PostgreSQLStore) ListActive(ctx context.Context) ([]Version, error) {
 
 func (s *PostgreSQLStore) Get(ctx context.Context, id string) (*Version, error) {
 	row := s.pool.QueryRow(ctx, `
-		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
 		FROM execution_plan_versions
 		WHERE id::text = $1
 	`, id)
@@ -112,6 +121,21 @@ func (s *PostgreSQLStore) Create(ctx context.Context, input CreateInput) (*Versi
 	return nil, fmt.Errorf("insert execution plan version after concurrent retries: %w", lastErr)
 }
 
+func (s *PostgreSQLStore) EnsureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	var lastErr error
+	for range 5 {
+		version, err := s.ensureManagedDefaultGlobal(ctx, input, planHash)
+		if err == nil {
+			return version, nil
+		}
+		if !isPostgreSQLUniqueViolation(err) {
+			return nil, err
+		}
+		lastErr = err
+	}
+	return nil, fmt.Errorf("ensure managed default execution plan after concurrent retries: %w", lastErr)
+}
+
 func (s *PostgreSQLStore) createVersion(ctx context.Context, input CreateInput, scopeKey, planHash string) (*Version, error) {
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
@@ -150,6 +174,114 @@ func (s *PostgreSQLStore) createVersion(ctx context.Context, input CreateInput,
 		ScopeKey:    scopeKey,
 		Version:     nextVersion,
 		Active:      input.Activate,
+		Managed:     input.Managed,
+		Name:        input.Name,
+		Description: input.Description,
+		Payload:     input.Payload,
+		PlanHash:    planHash,
+		CreatedAt:   now,
+	}
+
+	if _, err := tx.Exec(ctx, `
+		INSERT INTO execution_plan_versions (
+			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+	`,
+		version.ID,
+		nullIfEmpty(version.Scope.Provider),
+		nullIfEmpty(version.Scope.Model),
+		nullIfEmpty(version.Scope.UserPath),
+		version.ScopeKey,
+		version.Version,
+		version.Active,
+		version.Managed,
+		version.Name,
+		version.Description,
+		payloadJSON,
+		version.PlanHash,
+		version.CreatedAt,
+	); err != nil {
+		return nil, fmt.Errorf("insert execution plan version: %w", err)
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return nil, fmt.Errorf("commit execution plan version: %w", err)
+	}
+	return version, nil
+}
+
+func (s *PostgreSQLStore) ensureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("begin execution plan transaction: %w", err)
+	}
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	row := tx.QueryRow(ctx, `
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		FROM execution_plan_versions
+		WHERE scope_key = 'global' AND active = TRUE
+		ORDER BY created_at DESC, id DESC
+		LIMIT 1
+		FOR UPDATE
+	`)
+	activeVersion, err := scanPostgreSQLVersion(row)
+	hasActive := true
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			hasActive = false
+		} else {
+			return nil, fmt.Errorf("load active global execution plan: %w", err)
+		}
+	}
+	if hasActive {
+		if !activeVersion.Managed {
+			if err := tx.Commit(ctx); err != nil {
+				return nil, fmt.Errorf("commit execution plan transaction: %w", err)
+			}
+			return nil, nil
+		}
+		if strings.TrimSpace(activeVersion.Name) == input.Name &&
+			strings.TrimSpace(activeVersion.Description) == input.Description &&
+			strings.TrimSpace(activeVersion.PlanHash) == planHash {
+			if err := tx.Commit(ctx); err != nil {
+				return nil, fmt.Errorf("commit execution plan transaction: %w", err)
+			}
+			return nil, nil
+		}
+	}
+
+	var nextVersion int
+	if err := tx.QueryRow(ctx,
+		`SELECT COALESCE(MAX(version), 0) + 1 FROM execution_plan_versions WHERE scope_key = 'global'`,
+	).Scan(&nextVersion); err != nil {
+		return nil, fmt.Errorf("select next execution plan version: %w", err)
+	}
+
+	if hasActive {
+		if _, err := tx.Exec(ctx,
+			`UPDATE execution_plan_versions SET active = FALSE WHERE id = $1 AND active = TRUE`,
+			activeVersion.ID,
+		); err != nil {
+			return nil, fmt.Errorf("deactivate current execution plan version: %w", err)
+		}
+	}
+
+	payloadJSON, err := json.Marshal(input.Payload)
+	if err != nil {
+		return nil, fmt.Errorf("marshal execution plan payload: %w", err)
+	}
+
+	now := time.Now().UTC()
+	version := &Version{
+		ID:          uuid.NewString(),
+		Scope:       input.Scope,
+		ScopeKey:    "global",
+		Version:     nextVersion,
+		Active:      true,
+		Managed:     true,
 		Name:        input.Name,
 		Description: input.Description,
 		Payload:     input.Payload,
@@ -159,8 +291,8 @@ func (s *PostgreSQLStore) createVersion(ctx context.Context, input CreateInput,
 
 	if _, err := tx.Exec(ctx, `
 		INSERT INTO execution_plan_versions (
-			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
 	`,
 		version.ID,
 		nullIfEmpty(version.Scope.Provider),
@@ -169,6 +301,7 @@ func (s *PostgreSQLStore) createVersion(ctx context.Context, input CreateInput,
 		version.ScopeKey,
 		version.Version,
 		version.Active,
+		version.Managed,
 		version.Name,
 		version.Description,
 		payloadJSON,
@@ -222,6 +355,7 @@ func scanPostgreSQLVersion(scanner interface {
 		&version.ScopeKey,
 		&version.Version,
 		&version.Active,
+		&version.Managed,
 		&version.Name,
 		&version.Description,
 		&payloadJSON,
diff --git a/internal/executionplans/store_sqlite.go b/internal/executionplans/store_sqlite.go
index 4695a3a3..bbdee35d 100644
--- a/internal/executionplans/store_sqlite.go
+++ b/internal/executionplans/store_sqlite.go
@@ -32,6 +32,7 @@ func NewSQLiteStore(db *sql.DB) (*SQLiteStore, error) {
 			scope_key TEXT NOT NULL,
 			version INTEGER NOT NULL,
 			active INTEGER NOT NULL DEFAULT 1,
+			managed_default INTEGER NOT NULL DEFAULT 0,
 			name TEXT NOT NULL,
 			description TEXT NOT NULL DEFAULT '',
 			plan_payload JSON NOT NULL,
@@ -54,6 +55,19 @@ func NewSQLiteStore(db *sql.DB) (*SQLiteStore, error) {
 	if _, err := db.Exec(`ALTER TABLE execution_plan_versions ADD COLUMN scope_user_path TEXT`); err != nil && !isSQLiteDuplicateColumnError(err) {
 		return nil, fmt.Errorf("initialize execution plan versions table: %w", err)
 	}
+	if _, err := db.Exec(`ALTER TABLE execution_plan_versions ADD COLUMN managed_default INTEGER NOT NULL DEFAULT 0`); err != nil && !isSQLiteDuplicateColumnError(err) {
+		return nil, fmt.Errorf("initialize execution plan versions table: %w", err)
+	}
+	if _, err := db.Exec(`
+		UPDATE execution_plan_versions
+		SET managed_default = 1
+		WHERE managed_default = 0
+		  AND scope_key = 'global'
+		  AND name = ?
+		  AND description = ?
+	`, ManagedDefaultGlobalName, ManagedDefaultGlobalDescription); err != nil {
+		return nil, fmt.Errorf("initialize execution plan versions table: %w", err)
+	}
 
 	return &SQLiteStore{db: db}, nil
 }
@@ -68,7 +82,7 @@ func isSQLiteDuplicateColumnError(err error) bool {
 
 func (s *SQLiteStore) ListActive(ctx context.Context) ([]Version, error) {
 	rows, err := s.db.QueryContext(ctx, `
-		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
 		FROM execution_plan_versions
 		WHERE active = 1
 		ORDER BY created_at DESC, id DESC
@@ -84,7 +98,7 @@ func (s *SQLiteStore) ListActive(ctx context.Context) ([]Version, error) {
 
 func (s *SQLiteStore) Get(ctx context.Context, id string) (*Version, error) {
 	row := s.db.QueryRowContext(ctx, `
-		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
 		FROM execution_plan_versions
 		WHERE id = ?
 	`, id)
@@ -151,6 +165,126 @@ func (s *SQLiteStore) Create(ctx context.Context, input CreateInput) (*Version,
 		ScopeKey:    scopeKey,
 		Version:     nextVersion,
 		Active:      input.Activate,
+		Managed:     input.Managed,
+		Name:        input.Name,
+		Description: input.Description,
+		Payload:     input.Payload,
+		PlanHash:    planHash,
+		CreatedAt:   now,
+	}
+
+	if _, err := conn.ExecContext(ctx, `
+		INSERT INTO execution_plan_versions (
+			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		version.ID,
+		nullableString(version.Scope.Provider),
+		nullableString(version.Scope.Model),
+		nullableString(version.Scope.UserPath),
+		version.ScopeKey,
+		version.Version,
+		boolToSQLite(version.Active),
+		boolToSQLite(version.Managed),
+		version.Name,
+		version.Description,
+		string(payloadJSON),
+		version.PlanHash,
+		version.CreatedAt.Unix(),
+	); err != nil {
+		return nil, fmt.Errorf("insert execution plan version: %w", err)
+	}
+
+	if _, err := conn.ExecContext(ctx, `COMMIT`); err != nil {
+		return nil, fmt.Errorf("commit execution plan version: %w", err)
+	}
+	committed = true
+	return version, nil
+}
+
+func (s *SQLiteStore) EnsureManagedDefaultGlobal(ctx context.Context, input CreateInput, planHash string) (*Version, error) {
+	conn, err := s.db.Conn(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("acquire execution plan connection: %w", err)
+	}
+	defer func() {
+		_ = conn.Close()
+	}()
+	if _, err := conn.ExecContext(ctx, `BEGIN IMMEDIATE`); err != nil {
+		return nil, fmt.Errorf("begin execution plan transaction: %w", err)
+	}
+	committed := false
+	defer func() {
+		if committed {
+			return
+		}
+		_, _ = conn.ExecContext(context.Background(), `ROLLBACK`)
+	}()
+
+	row := conn.QueryRowContext(ctx, `
+		SELECT id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		FROM execution_plan_versions
+		WHERE scope_key = 'global' AND active = 1
+		ORDER BY created_at DESC, id DESC
+		LIMIT 1
+	`)
+	activeVersion, err := scanSQLiteVersion(row)
+	hasActive := true
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			hasActive = false
+		} else {
+			return nil, fmt.Errorf("load active global execution plan: %w", err)
+		}
+	}
+	if hasActive {
+		if !activeVersion.Managed {
+			if _, err := conn.ExecContext(ctx, `COMMIT`); err != nil {
+				return nil, fmt.Errorf("commit execution plan transaction: %w", err)
+			}
+			committed = true
+			return nil, nil
+		}
+		if strings.TrimSpace(activeVersion.Name) == input.Name &&
+			strings.TrimSpace(activeVersion.Description) == input.Description &&
+			strings.TrimSpace(activeVersion.PlanHash) == planHash {
+			if _, err := conn.ExecContext(ctx, `COMMIT`); err != nil {
+				return nil, fmt.Errorf("commit execution plan transaction: %w", err)
+			}
+			committed = true
+			return nil, nil
+		}
+	}
+
+	var nextVersion int
+	if err := conn.QueryRowContext(ctx,
+		`SELECT COALESCE(MAX(version), 0) + 1 FROM execution_plan_versions WHERE scope_key = 'global'`,
+	).Scan(&nextVersion); err != nil {
+		return nil, fmt.Errorf("select next execution plan version: %w", err)
+	}
+
+	if hasActive {
+		if _, err := conn.ExecContext(ctx,
+			`UPDATE execution_plan_versions SET active = 0 WHERE id = ? AND active = 1`,
+			activeVersion.ID,
+		); err != nil {
+			return nil, fmt.Errorf("deactivate current execution plan version: %w", err)
+		}
+	}
+
+	payloadJSON, err := json.Marshal(input.Payload)
+	if err != nil {
+		return nil, fmt.Errorf("marshal execution plan payload: %w", err)
+	}
+
+	now := time.Now().UTC()
+	version := &Version{
+		ID:          uuid.NewString(),
+		Scope:       input.Scope,
+		ScopeKey:    "global",
+		Version:     nextVersion,
+		Active:      true,
+		Managed:     true,
 		Name:        input.Name,
 		Description: input.Description,
 		Payload:     input.Payload,
@@ -160,8 +294,8 @@ func (s *SQLiteStore) Create(ctx context.Context, input CreateInput) (*Version,
 
 	if _, err := conn.ExecContext(ctx, `
 		INSERT INTO execution_plan_versions (
-			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, name, description, plan_payload, plan_hash, created_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+			id, scope_provider, scope_model, scope_user_path, scope_key, version, active, managed_default, name, description, plan_payload, plan_hash, created_at
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		version.ID,
 		nullableString(version.Scope.Provider),
@@ -170,6 +304,7 @@ func (s *SQLiteStore) Create(ctx context.Context, input CreateInput) (*Version,
 		version.ScopeKey,
 		version.Version,
 		boolToSQLite(version.Active),
+		boolToSQLite(version.Managed),
 		version.Name,
 		version.Description,
 		string(payloadJSON),
@@ -218,6 +353,7 @@ func scanSQLiteVersion(scanner interface {
 		scopeModel    sql.NullString
 		scopeUserPath sql.NullString
 		active        int
+		managed       int
 		payloadJSON   string
 		createdAtUnix int64
 	)
@@ -230,6 +366,7 @@ func scanSQLiteVersion(scanner interface {
 		&version.ScopeKey,
 		&version.Version,
 		&active,
+		&managed,
 		&version.Name,
 		&version.Description,
 		&payloadJSON,
@@ -245,6 +382,7 @@ func scanSQLiteVersion(scanner interface {
 		UserPath: storedScopeUserPath(version.ScopeKey, scopeUserPath.String),
 	}
 	version.Active = active != 0
+	version.Managed = managed != 0
 	version.CreatedAt = time.Unix(createdAtUnix, 0).UTC()
 	if err := json.Unmarshal([]byte(payloadJSON), &version.Payload); err != nil {
 		return Version{}, fmt.Errorf("decode execution plan payload %q: %w", version.ID, err)
diff --git a/internal/executionplans/types.go b/internal/executionplans/types.go
index 6f46a257..a5a774f0 100644
--- a/internal/executionplans/types.go
+++ b/internal/executionplans/types.go
@@ -73,6 +73,7 @@ type Version struct {
 	ScopeKey    string    `json:"scope_key" bson:"scope_key"`
 	Version     int       `json:"version" bson:"version"`
 	Active      bool      `json:"active" bson:"active"`
+	Managed     bool      `json:"managed_default,omitempty" bson:"managed_default,omitempty"`
 	Name        string    `json:"name" bson:"name"`
 	Description string    `json:"description,omitempty" bson:"description,omitempty"`
 	Payload     Payload   `json:"plan_payload" bson:"plan_payload"`
@@ -84,6 +85,7 @@ type Version struct {
 type CreateInput struct {
 	Scope       Scope
 	Activate    bool
+	Managed     bool
 	Name        string
 	Description string
 	Payload     Payload
@@ -189,5 +191,13 @@ func normalizeCreateInput(input CreateInput) (CreateInput, string, string, error
 	input.Name = strings.TrimSpace(input.Name)
 	input.Description = strings.TrimSpace(input.Description)
 	input.Payload = payload
+	if input.Managed && (scope.Provider != "" || scope.Model != "" || scope.UserPath != "") {
+		return CreateInput{}, "", "", newValidationError("managed default workflow must use global scope", nil)
+	}
+	if !input.Managed &&
+		input.Name == ManagedDefaultGlobalName &&
+		input.Description == ManagedDefaultGlobalDescription {
+		return CreateInput{}, "", "", newValidationError("managed default workflow name/description is reserved", nil)
+	}
 	return input, scopeKey, planHash, nil
 }
diff --git a/internal/executionplans/types_test.go b/internal/executionplans/types_test.go
index d4b58cb1..3a0f95d1 100644
--- a/internal/executionplans/types_test.go
+++ b/internal/executionplans/types_test.go
@@ -68,6 +68,48 @@ func TestNormalizeCreateInput_AllowsEmptyName(t *testing.T) {
 	}
 }
 
+func TestNormalizeCreateInput_RejectsReservedManagedDefaultIdentityForUserPlans(t *testing.T) {
+	t.Parallel()
+
+	_, _, _, err := normalizeCreateInput(CreateInput{
+		Scope:       Scope{},
+		Activate:    true,
+		Name:        ManagedDefaultGlobalName,
+		Description: ManagedDefaultGlobalDescription,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err == nil {
+		t.Fatal("normalizeCreateInput() error = nil, want validation error")
+	}
+	if !IsValidationError(err) {
+		t.Fatalf("normalizeCreateInput() error = %T, want validation error", err)
+	}
+}
+
+func TestNormalizeCreateInput_RejectsManagedDefaultForNonGlobalScope(t *testing.T) {
+	t.Parallel()
+
+	_, _, _, err := normalizeCreateInput(CreateInput{
+		Scope:    Scope{Provider: "openai"},
+		Activate: true,
+		Managed:  true,
+		Name:     ManagedDefaultGlobalName,
+		Payload: Payload{
+			SchemaVersion: 1,
+			Features:      FeatureFlags{Cache: true, Audit: true, Usage: true, Guardrails: false},
+		},
+	})
+	if err == nil {
+		t.Fatal("normalizeCreateInput() error = nil, want validation error")
+	}
+	if !IsValidationError(err) {
+		t.Fatalf("normalizeCreateInput() error = %T, want validation error", err)
+	}
+}
+
 func TestFeatureFlagsRuntimeFeatures_FallbackDefaultsToTrue(t *testing.T) {
 	features := FeatureFlags{
 		Cache:      true,
diff --git a/internal/guardrails/catalog.go b/internal/guardrails/catalog.go
new file mode 100644
index 00000000..e97e5649
--- /dev/null
+++ b/internal/guardrails/catalog.go
@@ -0,0 +1,11 @@
+package guardrails
+
+// Catalog resolves named guardrail references into executable pipelines.
+// BuildPipeline returns the compiled pipeline, a deterministic configuration hash
+// for cache/change detection, and an error. The hash should change whenever the
+// effective pipeline configuration changes; empty is reserved for "no pipeline".
+type Catalog interface {
+	Len() int
+	Names() []string
+	BuildPipeline(steps []StepReference) (*Pipeline, string, error)
+}
diff --git a/internal/guardrails/definitions.go b/internal/guardrails/definitions.go
new file mode 100644
index 00000000..928d8671
--- /dev/null
+++ b/internal/guardrails/definitions.go
@@ -0,0 +1,246 @@
+package guardrails
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"gomodel/internal/core"
+	"gomodel/internal/responsecache"
+)
+
+// Definition is one persisted reusable guardrail instance.
+type Definition struct {
+	Name        string          `json:"name" bson:"name"`
+	Type        string          `json:"type" bson:"type"`
+	Description string          `json:"description,omitempty" bson:"description,omitempty"`
+	UserPath    string          `json:"user_path,omitempty" bson:"user_path,omitempty"`
+	Config      json.RawMessage `json:"config" bson:"config"`
+	CreatedAt   time.Time       `json:"created_at" bson:"created_at"`
+	UpdatedAt   time.Time       `json:"updated_at" bson:"updated_at"`
+}
+
+// View is the admin-facing representation of a persisted guardrail.
+type View struct {
+	Definition
+	Summary string `json:"summary,omitempty"`
+}
+
+// ViewFromDefinition projects one guardrail definition into its admin-facing view.
+func ViewFromDefinition(def Definition) View {
+	return View{
+		Definition: cloneDefinition(def),
+		Summary:    summarizeDefinition(def),
+	}
+}
+
+// TypeOption is one allowed option for a typed guardrail config field.
+type TypeOption struct {
+	Value string `json:"value"`
+	Label string `json:"label"`
+}
+
+// TypeField describes one UI field for a guardrail type.
+type TypeField struct {
+	Key         string       `json:"key"`
+	Label       string       `json:"label"`
+	Input       string       `json:"input"`
+	Required    bool         `json:"required"`
+	Help        string       `json:"help,omitempty"`
+	Placeholder string       `json:"placeholder,omitempty"`
+	Options     []TypeOption `json:"options,omitempty"`
+}
+
+// TypeDefinition describes one supported guardrail type and its config schema.
+type TypeDefinition struct {
+	Type        string          `json:"type"`
+	Label       string          `json:"label"`
+	Description string          `json:"description,omitempty"`
+	Defaults    json.RawMessage `json:"defaults"`
+	Fields      []TypeField     `json:"fields"`
+}
+
+type systemPromptDefinitionConfig struct {
+	Mode    string `json:"mode"`
+	Content string `json:"content"`
+}
+
+func normalizeDefinition(def Definition) (Definition, error) {
+	def.Name = strings.TrimSpace(def.Name)
+	def.Type = strings.TrimSpace(def.Type)
+	def.Description = strings.TrimSpace(def.Description)
+	userPath, err := core.NormalizeUserPath(def.UserPath)
+	if err != nil {
+		return Definition{}, newValidationError("invalid user_path", err)
+	}
+	def.UserPath = userPath
+
+	if def.Name == "" {
+		return Definition{}, newValidationError("guardrail name is required", nil)
+	}
+	if def.Type == "" {
+		return Definition{}, newValidationError("guardrail type is required", nil)
+	}
+
+	switch def.Type {
+	case "system_prompt":
+		cfg, err := decodeSystemPromptDefinitionConfig(def.Config)
+		if err != nil {
+			return Definition{}, err
+		}
+		raw, err := json.Marshal(cfg)
+		if err != nil {
+			return Definition{}, newValidationError("marshal guardrail config", err)
+		}
+		def.Config = raw
+	default:
+		return Definition{}, newValidationError(`unknown guardrail type: "`+def.Type+`"`, nil)
+	}
+
+	return def, nil
+}
+
+func cloneDefinition(def Definition) Definition {
+	cloned := def
+	if len(def.Config) > 0 {
+		cloned.Config = append(json.RawMessage(nil), def.Config...)
+	}
+	return cloned
+}
+
+func cloneTypeDefinitions(defs []TypeDefinition) []TypeDefinition {
+	if len(defs) == 0 {
+		return []TypeDefinition{}
+	}
+	cloned := make([]TypeDefinition, 0, len(defs))
+	for _, def := range defs {
+		copyDef := def
+		if len(def.Defaults) > 0 {
+			copyDef.Defaults = append(json.RawMessage(nil), def.Defaults...)
+		}
+		if len(def.Fields) > 0 {
+			copyDef.Fields = append([]TypeField(nil), def.Fields...)
+			for i := range copyDef.Fields {
+				if len(copyDef.Fields[i].Options) > 0 {
+					copyDef.Fields[i].Options = append([]TypeOption(nil), copyDef.Fields[i].Options...)
+				}
+			}
+		}
+		cloned = append(cloned, copyDef)
+	}
+	return cloned
+}
+
+func decodeSystemPromptDefinitionConfig(raw json.RawMessage) (systemPromptDefinitionConfig, error) {
+	if len(bytes.TrimSpace(raw)) == 0 {
+		raw = []byte(`{}`)
+	}
+
+	var cfg systemPromptDefinitionConfig
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&cfg); err != nil {
+		return systemPromptDefinitionConfig{}, newValidationError("invalid system_prompt config: "+err.Error(), err)
+	}
+	if decoder.More() {
+		return systemPromptDefinitionConfig{}, newValidationError("invalid system_prompt config: trailing data", nil)
+	}
+
+	cfg.Mode = effectiveSystemPromptMode(cfg.Mode)
+	if !isValidSystemPromptMode(cfg.Mode) {
+		return systemPromptDefinitionConfig{}, newValidationError("system_prompt mode is invalid", nil)
+	}
+	cfg.Content = strings.TrimSpace(cfg.Content)
+	if cfg.Content == "" {
+		return systemPromptDefinitionConfig{}, newValidationError("system_prompt content is required", nil)
+	}
+	return cfg, nil
+}
+
+func buildDefinition(def Definition) (Guardrail, responsecache.GuardrailRuleDescriptor, error) {
+	switch def.Type {
+	case "system_prompt":
+		cfg, err := decodeSystemPromptDefinitionConfig(def.Config)
+		if err != nil {
+			return nil, responsecache.GuardrailRuleDescriptor{}, err
+		}
+		mode := SystemPromptMode(cfg.Mode)
+		instance, err := NewSystemPromptGuardrail(def.Name, mode, cfg.Content)
+		if err != nil {
+			return nil, responsecache.GuardrailRuleDescriptor{}, newValidationError("build system_prompt guardrail: "+err.Error(), err)
+		}
+		return instance, responsecache.GuardrailRuleDescriptor{
+			Name:    def.Name,
+			Type:    def.Type,
+			Mode:    string(mode),
+			Content: cfg.Content,
+		}, nil
+	default:
+		return nil, responsecache.GuardrailRuleDescriptor{}, newValidationError(`unknown guardrail type: "`+def.Type+`"`, nil)
+	}
+}
+
+func summarizeDefinition(def Definition) string {
+	switch def.Type {
+	case "system_prompt":
+		cfg, err := decodeSystemPromptDefinitionConfig(def.Config)
+		if err != nil {
+			return ""
+		}
+		content := strings.Join(strings.Fields(cfg.Content), " ")
+		const maxLen = 72
+		if len(content) > maxLen {
+			content = content[:maxLen-3] + "..."
+		}
+		if content == "" {
+			return cfg.Mode
+		}
+		return fmt.Sprintf("%s • %s", cfg.Mode, content)
+	default:
+		return ""
+	}
+}
+
+// TypeDefinitions returns the UI-facing definitions for supported guardrail types.
+func TypeDefinitions() []TypeDefinition {
+	return cloneTypeDefinitions([]TypeDefinition{
+		{
+			Type:        "system_prompt",
+			Label:       "System Prompt",
+			Description: "Injects, overrides, or decorates the system message before the request reaches the provider.",
+			Defaults:    mustMarshalRaw(systemPromptDefinitionConfig{Mode: string(SystemPromptInject), Content: ""}),
+			Fields: []TypeField{
+				{
+					Key:      "mode",
+					Label:    "Mode",
+					Input:    "select",
+					Required: true,
+					Help:     "Choose whether the prompt is injected only when absent, overrides existing system prompts, or decorates the first one.",
+					Options: []TypeOption{
+						{Value: string(SystemPromptInject), Label: "Inject"},
+						{Value: string(SystemPromptOverride), Label: "Override"},
+						{Value: string(SystemPromptDecorator), Label: "Decorator"},
+					},
+				},
+				{
+					Key:         "content",
+					Label:       "Content",
+					Input:       "textarea",
+					Required:    true,
+					Help:        "The system prompt text applied by this guardrail.",
+					Placeholder: "You are a precise assistant. Follow the compliance policy...",
+				},
+			},
+		},
+	})
+}
+
+func mustMarshalRaw(value any) json.RawMessage {
+	raw, err := json.Marshal(value)
+	if err != nil {
+		panic(err)
+	}
+	return raw
+}
diff --git a/internal/guardrails/factory.go b/internal/guardrails/factory.go
new file mode 100644
index 00000000..4f18326d
--- /dev/null
+++ b/internal/guardrails/factory.go
@@ -0,0 +1,158 @@
+package guardrails
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+
+	"gomodel/config"
+	"gomodel/internal/storage"
+)
+
+// Result holds the initialized guardrail service and any owned resources.
+type Result struct {
+	Service       *Service
+	Store         Store
+	Storage       storage.Storage
+	RefreshErrors <-chan error
+
+	stopRefresh func()
+	closeOnce   sync.Once
+	closeErr    error
+}
+
+// Close releases resources held by the guardrails subsystem.
+func (r *Result) Close() error {
+	if r == nil {
+		return nil
+	}
+	r.closeOnce.Do(func() {
+		if r.stopRefresh != nil {
+			r.stopRefresh()
+			r.stopRefresh = nil
+		}
+
+		var errs []error
+		if r.Store != nil {
+			if err := r.Store.Close(); err != nil {
+				errs = append(errs, fmt.Errorf("store close: %w", err))
+			}
+		}
+		if r.Storage != nil {
+			if err := r.Storage.Close(); err != nil {
+				errs = append(errs, fmt.Errorf("storage close: %w", err))
+			}
+		}
+		if len(errs) > 0 {
+			r.closeErr = fmt.Errorf("close errors: %w", errors.Join(errs...))
+		}
+	})
+	return r.closeErr
+}
+
+// New creates a guardrails subsystem with its own storage connection.
+func New(ctx context.Context, cfg *config.Config, refreshInterval time.Duration) (*Result, error) {
+	if cfg == nil {
+		return nil, fmt.Errorf("config is required")
+	}
+	storeConn, err := storage.New(ctx, cfg.Storage.BackendConfig())
+	if err != nil {
+		return nil, fmt.Errorf("failed to create storage: %w", err)
+	}
+	result, err := newResult(ctx, storeConn, refreshInterval)
+	if err != nil {
+		_ = storeConn.Close()
+		return nil, err
+	}
+	result.Storage = storeConn
+	return result, nil
+}
+
+// NewWithSharedStorage creates a guardrails subsystem using an existing storage connection.
+func NewWithSharedStorage(ctx context.Context, shared storage.Storage, refreshInterval time.Duration) (*Result, error) {
+	if shared == nil {
+		return nil, fmt.Errorf("shared storage is required")
+	}
+	return newResult(ctx, shared, refreshInterval)
+}
+
+func newResult(ctx context.Context, storeConn storage.Storage, refreshInterval time.Duration) (*Result, error) {
+	store, err := createStore(ctx, storeConn)
+	if err != nil {
+		return nil, err
+	}
+	service, err := NewService(store)
+	if err != nil {
+		return nil, err
+	}
+	if err := service.Refresh(ctx); err != nil {
+		return nil, err
+	}
+	stopRefresh, refreshErrors := startGuardrailRefreshLoop(ctx, service, refreshInterval)
+	return &Result{
+		Service:       service,
+		Store:         store,
+		RefreshErrors: refreshErrors,
+		stopRefresh:   stopRefresh,
+	}, nil
+}
+
+func createStore(ctx context.Context, store storage.Storage) (Store, error) {
+	return storage.ResolveBackend[Store](
+		store,
+		func(db *sql.DB) (Store, error) { return NewSQLiteStore(ctx, db) },
+		func(pool *pgxpool.Pool) (Store, error) { return NewPostgreSQLStore(ctx, pool) },
+		func(db *mongo.Database) (Store, error) { return NewMongoDBStore(ctx, db) },
+	)
+}
+
+func startGuardrailRefreshLoop(parent context.Context, service *Service, interval time.Duration) (func(), <-chan error) {
+	if parent == nil || service == nil {
+		errs := make(chan error)
+		close(errs)
+		return func() {}, errs
+	}
+	if interval <= 0 {
+		interval = time.Minute
+	}
+
+	ctx, cancel := context.WithCancel(parent)
+	done := make(chan struct{})
+	errs := make(chan error, 1)
+	var once sync.Once
+
+	go func() {
+		defer close(done)
+		defer close(errs)
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				refreshCtx, refreshCancel := context.WithTimeout(ctx, 30*time.Second)
+				if err := service.Refresh(refreshCtx); err != nil {
+					select {
+					case errs <- err:
+					default:
+					}
+				}
+				refreshCancel()
+			}
+		}
+	}()
+
+	return func() {
+		once.Do(func() {
+			cancel()
+			<-done
+		})
+	}, errs
+}
diff --git a/internal/guardrails/service.go b/internal/guardrails/service.go
new file mode 100644
index 00000000..8a84f0dc
--- /dev/null
+++ b/internal/guardrails/service.go
@@ -0,0 +1,290 @@
+package guardrails
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"sort"
+	"sync"
+
+	"gomodel/internal/core"
+)
+
+type serviceSnapshot struct {
+	definitions map[string]Definition
+	order       []string
+	registry    *Registry
+}
+
+// Service keeps reusable guardrails cached in memory and refreshes them from storage.
+type Service struct {
+	store Store
+
+	refreshMu sync.Mutex
+	mu        sync.RWMutex
+	snapshot  serviceSnapshot
+}
+
+// NewService creates a guardrail service backed by the provided store.
+func NewService(store Store) (*Service, error) {
+	if store == nil {
+		return nil, fmt.Errorf("store is required")
+	}
+	return &Service{
+		store: store,
+		snapshot: serviceSnapshot{
+			definitions: map[string]Definition{},
+			order:       []string{},
+			registry:    NewRegistry(),
+		},
+	}, nil
+}
+
+// Refresh reloads guardrails from storage and atomically swaps the in-memory snapshot.
+func (s *Service) Refresh(ctx context.Context) error {
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	return s.refreshLocked(ctx)
+}
+
+func (s *Service) refreshLocked(ctx context.Context) error {
+	definitions, err := s.store.List(ctx)
+	if err != nil {
+		return guardrailServiceError("list guardrails", err)
+	}
+	next, err := buildSnapshot(definitions)
+	if err != nil {
+		return guardrailServiceError("load guardrails", err)
+	}
+
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+	return nil
+}
+
+// UpsertDefinitions validates and upserts a definition set, then swaps the snapshot on success.
+func (s *Service) UpsertDefinitions(ctx context.Context, definitions []Definition) error {
+	if s == nil || len(definitions) == 0 {
+		return nil
+	}
+
+	normalized := make([]Definition, 0, len(definitions))
+	for _, definition := range definitions {
+		normalizedDefinition, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		normalized = append(normalized, normalizedDefinition)
+	}
+
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	currentDefinitions, err := s.store.List(ctx)
+	if err != nil {
+		return guardrailServiceError("list guardrails", err)
+	}
+	nextDefinitions := definitionMap(currentDefinitions)
+	for _, definition := range normalized {
+		nextDefinitions[definition.Name] = definition
+	}
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return err
+	}
+	if err := s.store.UpsertMany(ctx, normalized); err != nil {
+		return guardrailServiceError("upsert guardrails", err)
+	}
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+	return nil
+}
+
+// List returns all cached guardrail definitions sorted by name.
+func (s *Service) List() []Definition {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	result := make([]Definition, 0, len(s.snapshot.order))
+	for _, name := range s.snapshot.order {
+		result = append(result, cloneDefinition(s.snapshot.definitions[name]))
+	}
+	return result
+}
+
+// ListViews returns all cached guardrail definitions with lightweight summaries.
+func (s *Service) ListViews() []View {
+	definitions := s.List()
+	views := make([]View, 0, len(definitions))
+	for _, definition := range definitions {
+		views = append(views, ViewFromDefinition(definition))
+	}
+	return views
+}
+
+// Get returns one cached guardrail by name.
+func (s *Service) Get(name string) (*Definition, bool) {
+	name = normalizeDefinitionName(name)
+	if name == "" {
+		return nil, false
+	}
+
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	definition, ok := s.snapshot.definitions[name]
+	if !ok {
+		return nil, false
+	}
+	copy := cloneDefinition(definition)
+	return &copy, true
+}
+
+// Upsert validates and stores a guardrail definition, then swaps the snapshot on success.
+func (s *Service) Upsert(ctx context.Context, definition Definition) error {
+	normalized, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	currentDefinitions, err := s.store.List(ctx)
+	if err != nil {
+		return guardrailServiceError("list guardrails", err)
+	}
+	nextDefinitions := definitionMap(currentDefinitions)
+	nextDefinitions[normalized.Name] = normalized
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return err
+	}
+	if err := s.store.Upsert(ctx, normalized); err != nil {
+		return guardrailServiceError("upsert guardrail", err)
+	}
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+	return nil
+}
+
+// Delete removes a guardrail definition from storage and swaps the snapshot on success.
+func (s *Service) Delete(ctx context.Context, name string) error {
+	name = normalizeDefinitionName(name)
+	if name == "" {
+		return newValidationError("guardrail name is required", nil)
+	}
+
+	s.refreshMu.Lock()
+	defer s.refreshMu.Unlock()
+
+	currentDefinitions, err := s.store.List(ctx)
+	if err != nil {
+		return guardrailServiceError("list guardrails", err)
+	}
+	nextDefinitions := definitionMap(currentDefinitions)
+	delete(nextDefinitions, name)
+	next, err := buildSnapshot(definitionsFromMap(nextDefinitions))
+	if err != nil {
+		return err
+	}
+	if err := s.store.Delete(ctx, name); err != nil {
+		return guardrailServiceError("delete guardrail", err)
+	}
+	s.mu.Lock()
+	s.snapshot = next
+	s.mu.Unlock()
+	return nil
+}
+
+// TypeDefinitions returns the supported guardrail type schemas.
+func (s *Service) TypeDefinitions() []TypeDefinition {
+	return TypeDefinitions()
+}
+
+// Len returns the number of loaded guardrails.
+func (s *Service) Len() int {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return len(s.snapshot.order)
+}
+
+// Names returns the loaded guardrail names in sorted order.
+func (s *Service) Names() []string {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return append([]string(nil), s.snapshot.order...)
+}
+
+// BuildPipeline resolves named steps through the current in-memory guardrail registry.
+func (s *Service) BuildPipeline(steps []StepReference) (*Pipeline, string, error) {
+	if len(steps) == 0 {
+		return nil, "", nil
+	}
+
+	s.mu.RLock()
+	registry := s.snapshot.registry
+	s.mu.RUnlock()
+	if registry == nil {
+		return nil, "", core.NewProviderError("", http.StatusBadGateway, "guardrail catalog is not loaded", nil)
+	}
+	return registry.BuildPipeline(steps)
+}
+
+func buildSnapshot(definitions []Definition) (serviceSnapshot, error) {
+	next := serviceSnapshot{
+		definitions: make(map[string]Definition, len(definitions)),
+		order:       make([]string, 0, len(definitions)),
+		registry:    NewRegistry(),
+	}
+	for _, definition := range definitions {
+		normalized, err := normalizeDefinition(definition)
+		if err != nil {
+			return serviceSnapshot{}, fmt.Errorf("load guardrail %q: %w", definition.Name, err)
+		}
+		instance, descriptor, err := buildDefinition(normalized)
+		if err != nil {
+			return serviceSnapshot{}, fmt.Errorf("load guardrail %q: %w", normalized.Name, err)
+		}
+		if err := next.registry.Register(instance, descriptor); err != nil {
+			return serviceSnapshot{}, fmt.Errorf("register guardrail %q: %w", normalized.Name, err)
+		}
+		next.definitions[normalized.Name] = normalized
+		next.order = append(next.order, normalized.Name)
+	}
+	sort.Strings(next.order)
+	return next, nil
+}
+
+func definitionMap(definitions []Definition) map[string]Definition {
+	next := make(map[string]Definition, len(definitions))
+	for _, definition := range definitions {
+		next[definition.Name] = cloneDefinition(definition)
+	}
+	return next
+}
+
+func definitionsFromMap(definitions map[string]Definition) []Definition {
+	result := make([]Definition, 0, len(definitions))
+	for _, definition := range definitions {
+		result = append(result, definition)
+	}
+	return result
+}
+
+func guardrailServiceError(message string, err error) error {
+	if err == nil {
+		return nil
+	}
+	if gatewayErr, ok := errors.AsType[*core.GatewayError](err); ok {
+		return gatewayErr
+	}
+	if IsValidationError(err) {
+		return core.NewInvalidRequestError(message+": "+err.Error(), err)
+	}
+	return core.NewProviderError("", http.StatusBadGateway, message+": "+err.Error(), err)
+}
diff --git a/internal/guardrails/service_test.go b/internal/guardrails/service_test.go
new file mode 100644
index 00000000..bff44479
--- /dev/null
+++ b/internal/guardrails/service_test.go
@@ -0,0 +1,321 @@
+package guardrails
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"gomodel/internal/core"
+)
+
+type testStore struct {
+	definitions   map[string]Definition
+	listErr       error
+	upsertErr     error
+	upsertManyErr error
+	deleteErr     error
+}
+
+func newTestStore(definitions ...Definition) *testStore {
+	store := &testStore{definitions: make(map[string]Definition, len(definitions))}
+	for _, definition := range definitions {
+		store.definitions[definition.Name] = definition
+	}
+	return store
+}
+
+func (s *testStore) List(context.Context) ([]Definition, error) {
+	if s.listErr != nil {
+		return nil, s.listErr
+	}
+	result := make([]Definition, 0, len(s.definitions))
+	for _, definition := range s.definitions {
+		result = append(result, definition)
+	}
+	return result, nil
+}
+
+func (s *testStore) Get(_ context.Context, name string) (*Definition, error) {
+	definition, ok := s.definitions[name]
+	if !ok {
+		return nil, ErrNotFound
+	}
+	copy := definition
+	return &copy, nil
+}
+
+func (s *testStore) Upsert(_ context.Context, definition Definition) error {
+	if s.upsertErr != nil {
+		return s.upsertErr
+	}
+	s.definitions[definition.Name] = definition
+	return nil
+}
+
+func (s *testStore) UpsertMany(_ context.Context, definitions []Definition) error {
+	if s.upsertManyErr != nil {
+		return s.upsertManyErr
+	}
+	for _, definition := range definitions {
+		s.definitions[definition.Name] = definition
+	}
+	return nil
+}
+
+func (s *testStore) Delete(_ context.Context, name string) error {
+	if s.deleteErr != nil {
+		return s.deleteErr
+	}
+	if _, ok := s.definitions[name]; !ok {
+		return ErrNotFound
+	}
+	delete(s.definitions, name)
+	return nil
+}
+
+func (s *testStore) Close() error { return nil }
+
+func rawConfig(t *testing.T, value any) json.RawMessage {
+	t.Helper()
+	raw, err := json.Marshal(value)
+	if err != nil {
+		t.Fatalf("json.Marshal() error = %v", err)
+	}
+	return raw
+}
+
+func TestServiceRefreshBuildsPipelineFromDefinitions(t *testing.T) {
+	store := newTestStore(
+		Definition{
+			Name: "safety",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "inject",
+				"content": "be safe",
+			}),
+		},
+	)
+
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh() error = %v", err)
+	}
+
+	if got := service.Names(); len(got) != 1 || got[0] != "safety" {
+		t.Fatalf("Names() = %v, want [safety]", got)
+	}
+
+	pipeline, hash, err := service.BuildPipeline([]StepReference{{Ref: "safety", Step: 10}})
+	if err != nil {
+		t.Fatalf("BuildPipeline() error = %v", err)
+	}
+	if pipeline == nil || pipeline.Len() != 1 {
+		t.Fatalf("pipeline = %#v, want one entry", pipeline)
+	}
+	if hash == "" {
+		t.Fatal("BuildPipeline() hash = empty, want non-empty")
+	}
+
+	msgs, err := pipeline.Process(context.Background(), []Message{{Role: "user", Content: "hi"}})
+	if err != nil {
+		t.Fatalf("Process() error = %v", err)
+	}
+	if len(msgs) != 2 || msgs[0].Role != "system" || msgs[0].Content != "be safe" {
+		t.Fatalf("Process() messages = %#v, want injected system prompt", msgs)
+	}
+}
+
+func TestServiceRefresh_ReturnsGatewayErrorOnStoreFailure(t *testing.T) {
+	store := &testStore{
+		definitions: map[string]Definition{},
+		listErr:     errors.New("boom"),
+	}
+
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	err = service.Refresh(context.Background())
+	if err == nil {
+		t.Fatal("Refresh() error = nil, want gateway error")
+	}
+	var gatewayErr *core.GatewayError
+	if !errors.As(err, &gatewayErr) {
+		t.Fatalf("Refresh() error = %T, want *core.GatewayError", err)
+	}
+}
+
+func TestServiceBuildPipeline_ReturnsGatewayErrorWhenCatalogMissing(t *testing.T) {
+	service := &Service{}
+
+	_, _, err := service.BuildPipeline([]StepReference{{Ref: "policy", Step: 10}})
+	if err == nil {
+		t.Fatal("BuildPipeline() error = nil, want gateway error")
+	}
+	var gatewayErr *core.GatewayError
+	if !errors.As(err, &gatewayErr) {
+		t.Fatalf("BuildPipeline() error = %T, want *core.GatewayError", err)
+	}
+}
+
+func TestServiceUpsertDefinitions_UpdatesConfiguredSubsetAndPreservesCustomEntries(t *testing.T) {
+	store := newTestStore(
+		Definition{
+			Name: "policy",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "inject",
+				"content": "old policy text",
+			}),
+		},
+		Definition{
+			Name: "custom",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "inject",
+				"content": "custom",
+			}),
+		},
+	)
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+
+	if err := service.UpsertDefinitions(context.Background(), []Definition{
+		{
+			Name: "policy",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "override",
+				"content": "policy text",
+			}),
+		},
+		{
+			Name: "policy-v2",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "inject",
+				"content": "new policy",
+			}),
+		},
+	}); err != nil {
+		t.Fatalf("UpsertDefinitions() error = %v", err)
+	}
+
+	if got := service.Names(); len(got) != 3 || got[0] != "custom" || got[1] != "policy" || got[2] != "policy-v2" {
+		t.Fatalf("Names() after upsert = %v, want [custom policy policy-v2]", got)
+	}
+
+	definition, ok := service.Get("policy")
+	if !ok || definition == nil {
+		t.Fatal("Get(policy) = missing, want updated guardrail")
+	}
+	var gotConfig map[string]any
+	if err := json.Unmarshal(definition.Config, &gotConfig); err != nil {
+		t.Fatalf("json.Unmarshal(policy.Config) error = %v", err)
+	}
+	if gotConfig["mode"] != "override" || gotConfig["content"] != "policy text" {
+		t.Fatalf("policy.Config = %#v, want updated config", gotConfig)
+	}
+
+	if _, ok := store.definitions["custom"]; !ok {
+		t.Fatal("custom guardrail missing after UpsertDefinitions(), want preserved entry")
+	}
+}
+
+func TestServiceUpsertDefinitions_LeavesSnapshotUnchangedWhenPersistenceFails(t *testing.T) {
+	store := newTestStore(Definition{
+		Name: "policy",
+		Type: "system_prompt",
+		Config: rawConfig(t, map[string]any{
+			"mode":    "inject",
+			"content": "policy text",
+		}),
+	})
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+	if err := service.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh() error = %v", err)
+	}
+
+	store.upsertManyErr = errors.New("boom")
+	err = service.UpsertDefinitions(context.Background(), []Definition{
+		{
+			Name: "policy-v2",
+			Type: "system_prompt",
+			Config: rawConfig(t, map[string]any{
+				"mode":    "inject",
+				"content": "new policy",
+			}),
+		},
+	})
+	if err == nil {
+		t.Fatal("UpsertDefinitions() error = nil, want persistence failure")
+	}
+
+	if got := service.Names(); len(got) != 1 || got[0] != "policy" {
+		t.Fatalf("Names() after failed UpsertDefinitions = %v, want unchanged [policy]", got)
+	}
+}
+
+func TestServiceUpsertRejectsInvalidSystemPromptMode(t *testing.T) {
+	store := newTestStore()
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+
+	err = service.Upsert(context.Background(), Definition{
+		Name: "policy",
+		Type: "system_prompt",
+		Config: rawConfig(t, map[string]any{
+			"mode":    "invalid",
+			"content": "policy text",
+		}),
+	})
+	if err == nil {
+		t.Fatal("Upsert() error = nil, want validation error")
+	}
+	if !IsValidationError(err) {
+		t.Fatalf("Upsert() error = %v, want validation error", err)
+	}
+	if len(store.definitions) != 0 {
+		t.Fatalf("len(store.definitions) = %d, want 0", len(store.definitions))
+	}
+}
+
+func TestServiceUpsertNormalizesUserPath(t *testing.T) {
+	store := newTestStore()
+	service, err := NewService(store)
+	if err != nil {
+		t.Fatalf("NewService() error = %v", err)
+	}
+
+	err = service.Upsert(context.Background(), Definition{
+		Name:     "policy",
+		Type:     "system_prompt",
+		UserPath: "team/alpha",
+		Config: rawConfig(t, map[string]any{
+			"mode":    "inject",
+			"content": "policy text",
+		}),
+	})
+	if err != nil {
+		t.Fatalf("Upsert() error = %v", err)
+	}
+
+	definition, ok := service.Get("policy")
+	if !ok || definition == nil {
+		t.Fatal("Get(policy) = missing, want stored guardrail")
+	}
+	if definition.UserPath != "/team/alpha" {
+		t.Fatalf("definition.UserPath = %q, want /team/alpha", definition.UserPath)
+	}
+}
diff --git a/internal/guardrails/store.go b/internal/guardrails/store.go
new file mode 100644
index 00000000..2ab18b21
--- /dev/null
+++ b/internal/guardrails/store.go
@@ -0,0 +1,95 @@
+package guardrails
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+)
+
+// ErrNotFound indicates a requested guardrail was not found.
+var ErrNotFound = errors.New("guardrail not found")
+
+// ValidationError indicates invalid guardrail input or state.
+type ValidationError struct {
+	Message string
+	Err     error
+}
+
+func (e *ValidationError) Error() string {
+	if e == nil {
+		return ""
+	}
+	return e.Message
+}
+
+func (e *ValidationError) Unwrap() error {
+	if e == nil {
+		return nil
+	}
+	return e.Err
+}
+
+func newValidationError(message string, err error) error {
+	return &ValidationError{Message: message, Err: err}
+}
+
+// IsValidationError reports whether err is a validation error.
+func IsValidationError(err error) bool {
+	_, ok := errors.AsType[*ValidationError](err)
+	return ok
+}
+
+// Store defines persistence operations for reusable guardrail definitions.
+type Store interface {
+	List(ctx context.Context) ([]Definition, error)
+	Get(ctx context.Context, name string) (*Definition, error)
+	Upsert(ctx context.Context, definition Definition) error
+	UpsertMany(ctx context.Context, definitions []Definition) error
+	Delete(ctx context.Context, name string) error
+	Close() error
+}
+
+type definitionScanner interface {
+	Scan(dest ...any) error
+}
+
+type definitionRows interface {
+	definitionScanner
+	Next() bool
+	Err() error
+}
+
+func normalizeDefinitionName(name string) string {
+	return strings.TrimSpace(name)
+}
+
+func collectDefinitions(rows definitionRows, scan func(definitionScanner) (Definition, error)) ([]Definition, error) {
+	result := make([]Definition, 0)
+	for rows.Next() {
+		definition, err := scan(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, definition)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return result, nil
+}
+
+func nullableString(value string) any {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return nil
+	}
+	return value
+}
+
+func nullableStringValue(value sql.NullString) string {
+	if !value.Valid {
+		return ""
+	}
+	return strings.TrimSpace(value.String)
+}
diff --git a/internal/guardrails/store_mongodb.go b/internal/guardrails/store_mongodb.go
new file mode 100644
index 00000000..f65b381f
--- /dev/null
+++ b/internal/guardrails/store_mongodb.go
@@ -0,0 +1,239 @@
+package guardrails
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+	"go.mongodb.org/mongo-driver/v2/mongo"
+	"go.mongodb.org/mongo-driver/v2/mongo/options"
+)
+
+type mongoDefinitionDocument struct {
+	Name        string    `bson:"_id"`
+	Type        string    `bson:"type"`
+	Description string    `bson:"description,omitempty"`
+	UserPath    string    `bson:"user_path,omitempty"`
+	Config      bson.M    `bson:"config"`
+	CreatedAt   time.Time `bson:"created_at"`
+	UpdatedAt   time.Time `bson:"updated_at"`
+}
+
+type mongoDefinitionIDFilter struct {
+	ID string `bson:"_id"`
+}
+
+// MongoDBStore stores guardrail definitions in MongoDB.
+type MongoDBStore struct {
+	collection *mongo.Collection
+}
+
+// NewMongoDBStore creates collection indexes if needed.
+func NewMongoDBStore(ctx context.Context, database *mongo.Database) (*MongoDBStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if database == nil {
+		return nil, fmt.Errorf("database is required")
+	}
+	coll := database.Collection("guardrail_definitions")
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	indexes := []mongo.IndexModel{
+		{Keys: bson.D{{Key: "type", Value: 1}}},
+		{Keys: bson.D{{Key: "updated_at", Value: -1}}},
+	}
+	if _, err := coll.Indexes().CreateMany(ctx, indexes); err != nil {
+		return nil, fmt.Errorf("create guardrail indexes: %w", err)
+	}
+	return &MongoDBStore{collection: coll}, nil
+}
+
+func (s *MongoDBStore) List(ctx context.Context) ([]Definition, error) {
+	cursor, err := s.collection.Find(ctx, bson.M{}, options.Find().SetSort(bson.D{{Key: "_id", Value: 1}}))
+	if err != nil {
+		return nil, fmt.Errorf("list guardrails: %w", err)
+	}
+	defer cursor.Close(ctx)
+
+	result := make([]Definition, 0)
+	for cursor.Next(ctx) {
+		var doc mongoDefinitionDocument
+		if err := cursor.Decode(&doc); err != nil {
+			return nil, fmt.Errorf("decode guardrail: %w", err)
+		}
+		definition, err := definitionFromMongo(doc)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, definition)
+	}
+	if err := cursor.Err(); err != nil {
+		return nil, fmt.Errorf("iterate guardrails: %w", err)
+	}
+	return result, nil
+}
+
+func (s *MongoDBStore) Get(ctx context.Context, name string) (*Definition, error) {
+	var doc mongoDefinitionDocument
+	err := s.collection.FindOne(ctx, mongoDefinitionIDFilter{ID: normalizeDefinitionName(name)}).Decode(&doc)
+	if err != nil {
+		if errors.Is(err, mongo.ErrNoDocuments) {
+			return nil, ErrNotFound
+		}
+		return nil, fmt.Errorf("get guardrail: %w", err)
+	}
+	definition, err := definitionFromMongo(doc)
+	if err != nil {
+		return nil, err
+	}
+	return &definition, nil
+}
+
+func (s *MongoDBStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+	now := time.Now().UTC()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = now
+	}
+	definition.UpdatedAt = now
+
+	configDoc, err := mongoConfigFromRaw(definition.Config)
+	if err != nil {
+		return fmt.Errorf("upsert guardrail: %w", err)
+	}
+
+	update := bson.M{
+		"$set": bson.M{
+			"type":        definition.Type,
+			"description": definition.Description,
+			"user_path":   definition.UserPath,
+			"config":      configDoc,
+			"updated_at":  definition.UpdatedAt,
+		},
+		"$setOnInsert": bson.M{
+			"created_at": definition.CreatedAt,
+		},
+	}
+	_, err = s.collection.UpdateOne(ctx, mongoDefinitionIDFilter{ID: definition.Name}, update, options.UpdateOne().SetUpsert(true))
+	if err != nil {
+		return fmt.Errorf("upsert guardrail: %w", err)
+	}
+	return nil
+}
+
+func (s *MongoDBStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+
+	now := time.Now().UTC()
+	models := make([]mongo.WriteModel, 0, len(definitions))
+	for _, definition := range definitions {
+		normalized, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		if normalized.CreatedAt.IsZero() {
+			normalized.CreatedAt = now
+		}
+		normalized.UpdatedAt = now
+
+		configDoc, err := mongoConfigFromRaw(normalized.Config)
+		if err != nil {
+			return fmt.Errorf("upsert guardrail %q: %w", normalized.Name, err)
+		}
+
+		update := bson.M{
+			"$set": bson.M{
+				"type":        normalized.Type,
+				"description": normalized.Description,
+				"user_path":   normalized.UserPath,
+				"config":      configDoc,
+				"updated_at":  normalized.UpdatedAt,
+			},
+			"$setOnInsert": bson.M{
+				"created_at": normalized.CreatedAt,
+			},
+		}
+		models = append(models, mongo.NewUpdateOneModel().
+			SetFilter(mongoDefinitionIDFilter{ID: normalized.Name}).
+			SetUpdate(update).
+			SetUpsert(true))
+	}
+
+	session, err := s.collection.Database().Client().StartSession()
+	if err != nil {
+		return fmt.Errorf("start guardrail upsert session: %w", err)
+	}
+	defer session.EndSession(ctx)
+
+	_, err = session.WithTransaction(ctx, func(sessionCtx context.Context) (any, error) {
+		if _, err := s.collection.BulkWrite(sessionCtx, models, options.BulkWrite().SetOrdered(true)); err != nil {
+			return nil, fmt.Errorf("bulk upsert guardrails: %w", err)
+		}
+		return nil, nil
+	})
+	if err != nil {
+		return fmt.Errorf("upsert guardrails: %w", err)
+	}
+	return nil
+}
+
+func (s *MongoDBStore) Delete(ctx context.Context, name string) error {
+	result, err := s.collection.DeleteOne(ctx, mongoDefinitionIDFilter{ID: normalizeDefinitionName(name)})
+	if err != nil {
+		return fmt.Errorf("delete guardrail: %w", err)
+	}
+	if result.DeletedCount == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *MongoDBStore) Close() error {
+	return nil
+}
+
+func mongoConfigFromRaw(raw json.RawMessage) (bson.M, error) {
+	trimmed := bytes.TrimSpace(raw)
+	if len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
+		return bson.M{}, nil
+	}
+	var doc bson.M
+	if err := json.Unmarshal(trimmed, &doc); err != nil {
+		return nil, fmt.Errorf("decode guardrail config: %w", err)
+	}
+	if doc == nil {
+		return bson.M{}, nil
+	}
+	return doc, nil
+}
+
+func definitionFromMongo(doc mongoDefinitionDocument) (Definition, error) {
+	config := doc.Config
+	if config == nil {
+		config = bson.M{}
+	}
+	raw, err := json.Marshal(config)
+	if err != nil {
+		return Definition{}, fmt.Errorf("encode guardrail config %q: %w", doc.Name, err)
+	}
+	return Definition{
+		Name:        doc.Name,
+		Type:        doc.Type,
+		Description: doc.Description,
+		UserPath:    doc.UserPath,
+		Config:      raw,
+		CreatedAt:   doc.CreatedAt.UTC(),
+		UpdatedAt:   doc.UpdatedAt.UTC(),
+	}, nil
+}
diff --git a/internal/guardrails/store_mongodb_test.go b/internal/guardrails/store_mongodb_test.go
new file mode 100644
index 00000000..15b5c1ed
--- /dev/null
+++ b/internal/guardrails/store_mongodb_test.go
@@ -0,0 +1,58 @@
+package guardrails
+
+import (
+	"encoding/json"
+	"testing"
+
+	"go.mongodb.org/mongo-driver/v2/bson"
+)
+
+func TestMongoConfigFromRaw_NormalizesEmptyAndNullToEmptyDocument(t *testing.T) {
+	t.Parallel()
+
+	for _, raw := range []json.RawMessage{
+		nil,
+		json.RawMessage(""),
+		json.RawMessage("   "),
+		json.RawMessage("null"),
+	} {
+		doc, err := mongoConfigFromRaw(raw)
+		if err != nil {
+			t.Fatalf("mongoConfigFromRaw(%q) error = %v", raw, err)
+		}
+		if doc == nil {
+			t.Fatalf("mongoConfigFromRaw(%q) = nil, want empty document", raw)
+		}
+		if len(doc) != 0 {
+			t.Fatalf("mongoConfigFromRaw(%q) = %#v, want empty document", raw, doc)
+		}
+	}
+}
+
+func TestDefinitionFromMongo_NormalizesNilConfigToEmptyObject(t *testing.T) {
+	t.Parallel()
+
+	definition, err := definitionFromMongo(mongoDefinitionDocument{
+		Name:   "policy",
+		Type:   "system_prompt",
+		Config: nil,
+	})
+	if err != nil {
+		t.Fatalf("definitionFromMongo() error = %v", err)
+	}
+	if got := string(definition.Config); got != "{}" {
+		t.Fatalf("definition.Config = %q, want {}", got)
+	}
+
+	definition, err = definitionFromMongo(mongoDefinitionDocument{
+		Name:   "policy",
+		Type:   "system_prompt",
+		Config: bson.M{},
+	})
+	if err != nil {
+		t.Fatalf("definitionFromMongo() with empty map error = %v", err)
+	}
+	if got := string(definition.Config); got != "{}" {
+		t.Fatalf("definition.Config from empty map = %q, want {}", got)
+	}
+}
diff --git a/internal/guardrails/store_postgresql.go b/internal/guardrails/store_postgresql.go
new file mode 100644
index 00000000..5d3f21df
--- /dev/null
+++ b/internal/guardrails/store_postgresql.go
@@ -0,0 +1,190 @@
+package guardrails
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// PostgreSQLStore stores guardrail definitions in PostgreSQL.
+type PostgreSQLStore struct {
+	pool *pgxpool.Pool
+}
+
+// NewPostgreSQLStore creates the guardrail table and indexes if needed.
+func NewPostgreSQLStore(ctx context.Context, pool *pgxpool.Pool) (*PostgreSQLStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if pool == nil {
+		return nil, fmt.Errorf("connection pool is required")
+	}
+
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS guardrail_definitions (
+			name TEXT PRIMARY KEY,
+			type TEXT NOT NULL,
+			description TEXT NOT NULL DEFAULT '',
+			user_path TEXT,
+			config JSONB NOT NULL,
+			created_at BIGINT NOT NULL,
+			updated_at BIGINT NOT NULL
+		)`,
+		`ALTER TABLE guardrail_definitions ADD COLUMN IF NOT EXISTS user_path TEXT`,
+		`CREATE INDEX IF NOT EXISTS idx_guardrail_definitions_type ON guardrail_definitions(type)`,
+		`CREATE INDEX IF NOT EXISTS idx_guardrail_definitions_updated_at ON guardrail_definitions(updated_at DESC)`,
+	}
+	for _, statement := range statements {
+		if _, err := pool.Exec(ctx, statement); err != nil {
+			return nil, fmt.Errorf("initialize guardrail definitions table: %w", err)
+		}
+	}
+
+	return &PostgreSQLStore{pool: pool}, nil
+}
+
+func (s *PostgreSQLStore) List(ctx context.Context) ([]Definition, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT name, type, description, user_path, config, created_at, updated_at
+		FROM guardrail_definitions
+		ORDER BY name ASC
+	`)
+	if err != nil {
+		return nil, fmt.Errorf("list guardrails: %w", err)
+	}
+	defer rows.Close()
+	return collectDefinitions(rows, scanPostgreSQLDefinition)
+}
+
+func (s *PostgreSQLStore) Get(ctx context.Context, name string) (*Definition, error) {
+	row := s.pool.QueryRow(ctx, `
+		SELECT name, type, description, user_path, config, created_at, updated_at
+		FROM guardrail_definitions
+		WHERE name = $1
+	`, normalizeDefinitionName(name))
+	definition, err := scanPostgreSQLDefinition(row)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return &definition, nil
+}
+
+func (s *PostgreSQLStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+
+	now := time.Now().UTC().Unix()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = time.Unix(now, 0).UTC()
+	}
+	definition.UpdatedAt = time.Unix(now, 0).UTC()
+
+	_, err = s.pool.Exec(ctx, `
+		INSERT INTO guardrail_definitions (name, type, description, user_path, config, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7)
+		ON CONFLICT(name) DO UPDATE SET
+			type = excluded.type,
+			description = excluded.description,
+			user_path = excluded.user_path,
+			config = excluded.config,
+			updated_at = excluded.updated_at
+	`, definition.Name, definition.Type, definition.Description, nullableString(definition.UserPath), definition.Config, definition.CreatedAt.Unix(), definition.UpdatedAt.Unix())
+	if err != nil {
+		return fmt.Errorf("upsert guardrail: %w", err)
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin guardrail upsert transaction: %w", err)
+	}
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	now := time.Now().UTC().Unix()
+	for _, definition := range definitions {
+		normalized, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		if normalized.CreatedAt.IsZero() {
+			normalized.CreatedAt = time.Unix(now, 0).UTC()
+		}
+		normalized.UpdatedAt = time.Unix(now, 0).UTC()
+
+		if _, err := tx.Exec(ctx, `
+			INSERT INTO guardrail_definitions (name, type, description, user_path, config, created_at, updated_at)
+			VALUES ($1, $2, $3, $4, $5, $6, $7)
+			ON CONFLICT(name) DO UPDATE SET
+				type = excluded.type,
+				description = excluded.description,
+				user_path = excluded.user_path,
+				config = excluded.config,
+				updated_at = excluded.updated_at
+		`, normalized.Name, normalized.Type, normalized.Description, nullableString(normalized.UserPath), normalized.Config, normalized.CreatedAt.Unix(), normalized.UpdatedAt.Unix()); err != nil {
+			return fmt.Errorf("upsert guardrail %q: %w", normalized.Name, err)
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit guardrail upsert transaction: %w", err)
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) Delete(ctx context.Context, name string) error {
+	tag, err := s.pool.Exec(ctx, `DELETE FROM guardrail_definitions WHERE name = $1`, normalizeDefinitionName(name))
+	if err != nil {
+		return fmt.Errorf("delete guardrail: %w", err)
+	}
+	if tag.RowsAffected() == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *PostgreSQLStore) Close() error {
+	return nil
+}
+
+func scanPostgreSQLDefinition(scanner definitionScanner) (Definition, error) {
+	var (
+		definition    Definition
+		userPath      sql.NullString
+		configJSON    []byte
+		createdAtUnix int64
+		updatedAtUnix int64
+	)
+	if err := scanner.Scan(
+		&definition.Name,
+		&definition.Type,
+		&definition.Description,
+		&userPath,
+		&configJSON,
+		&createdAtUnix,
+		&updatedAtUnix,
+	); err != nil {
+		return Definition{}, err
+	}
+	definition.UserPath = nullableStringValue(userPath)
+	definition.Config = append([]byte(nil), configJSON...)
+	definition.CreatedAt = time.Unix(createdAtUnix, 0).UTC()
+	definition.UpdatedAt = time.Unix(updatedAtUnix, 0).UTC()
+	return definition, nil
+}
diff --git a/internal/guardrails/store_sqlite.go b/internal/guardrails/store_sqlite.go
new file mode 100644
index 00000000..850f5336
--- /dev/null
+++ b/internal/guardrails/store_sqlite.go
@@ -0,0 +1,206 @@
+package guardrails
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// SQLiteStore stores guardrail definitions in SQLite.
+type SQLiteStore struct {
+	db *sql.DB
+}
+
+// NewSQLiteStore creates the guardrail table and indexes if needed.
+func NewSQLiteStore(ctx context.Context, db *sql.DB) (*SQLiteStore, error) {
+	if ctx == nil {
+		return nil, fmt.Errorf("context is required")
+	}
+	if db == nil {
+		return nil, fmt.Errorf("database connection is required")
+	}
+
+	statements := []string{
+		`CREATE TABLE IF NOT EXISTS guardrail_definitions (
+			name TEXT PRIMARY KEY,
+			type TEXT NOT NULL,
+			description TEXT NOT NULL DEFAULT '',
+			user_path TEXT,
+			config JSON NOT NULL,
+			created_at INTEGER NOT NULL,
+			updated_at INTEGER NOT NULL
+		)`,
+		`ALTER TABLE guardrail_definitions ADD COLUMN user_path TEXT`,
+		`CREATE INDEX IF NOT EXISTS idx_guardrail_definitions_type ON guardrail_definitions(type)`,
+		`CREATE INDEX IF NOT EXISTS idx_guardrail_definitions_updated_at ON guardrail_definitions(updated_at DESC)`,
+	}
+	for _, statement := range statements {
+		if _, err := db.ExecContext(ctx, statement); err != nil {
+			if statement == `ALTER TABLE guardrail_definitions ADD COLUMN user_path TEXT` && isSQLiteDuplicateColumnError(err) {
+				continue
+			}
+			return nil, fmt.Errorf("initialize guardrail definitions table: %w", err)
+		}
+	}
+
+	return &SQLiteStore{db: db}, nil
+}
+
+func (s *SQLiteStore) List(ctx context.Context) ([]Definition, error) {
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT name, type, description, user_path, config, created_at, updated_at
+		FROM guardrail_definitions
+		ORDER BY name ASC
+	`)
+	if err != nil {
+		return nil, fmt.Errorf("list guardrails: %w", err)
+	}
+	defer rows.Close()
+	return collectDefinitions(rows, scanSQLiteDefinition)
+}
+
+func (s *SQLiteStore) Get(ctx context.Context, name string) (*Definition, error) {
+	row := s.db.QueryRowContext(ctx, `
+		SELECT name, type, description, user_path, config, created_at, updated_at
+		FROM guardrail_definitions
+		WHERE name = ?
+	`, normalizeDefinitionName(name))
+	definition, err := scanSQLiteDefinition(row)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, err
+	}
+	return &definition, nil
+}
+
+func (s *SQLiteStore) Upsert(ctx context.Context, definition Definition) error {
+	definition, err := normalizeDefinition(definition)
+	if err != nil {
+		return err
+	}
+
+	now := time.Now().UTC().Unix()
+	if definition.CreatedAt.IsZero() {
+		definition.CreatedAt = time.Unix(now, 0).UTC()
+	}
+	definition.UpdatedAt = time.Unix(now, 0).UTC()
+
+	_, err = s.db.ExecContext(ctx, `
+		INSERT INTO guardrail_definitions (name, type, description, user_path, config, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?)
+		ON CONFLICT(name) DO UPDATE SET
+			type = excluded.type,
+			description = excluded.description,
+			user_path = excluded.user_path,
+			config = excluded.config,
+			updated_at = excluded.updated_at
+	`, definition.Name, definition.Type, definition.Description, nullableString(definition.UserPath), string(definition.Config), definition.CreatedAt.Unix(), definition.UpdatedAt.Unix())
+	if err != nil {
+		return fmt.Errorf("upsert guardrail: %w", err)
+	}
+	return nil
+}
+
+func (s *SQLiteStore) UpsertMany(ctx context.Context, definitions []Definition) error {
+	if len(definitions) == 0 {
+		return nil
+	}
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("begin guardrail upsert transaction: %w", err)
+	}
+	defer func() {
+		_ = tx.Rollback()
+	}()
+
+	now := time.Now().UTC().Unix()
+	for _, definition := range definitions {
+		normalized, err := normalizeDefinition(definition)
+		if err != nil {
+			return err
+		}
+		if normalized.CreatedAt.IsZero() {
+			normalized.CreatedAt = time.Unix(now, 0).UTC()
+		}
+		normalized.UpdatedAt = time.Unix(now, 0).UTC()
+
+		if _, err := tx.ExecContext(ctx, `
+			INSERT INTO guardrail_definitions (name, type, description, user_path, config, created_at, updated_at)
+			VALUES (?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT(name) DO UPDATE SET
+				type = excluded.type,
+				description = excluded.description,
+				user_path = excluded.user_path,
+				config = excluded.config,
+				updated_at = excluded.updated_at
+		`, normalized.Name, normalized.Type, normalized.Description, nullableString(normalized.UserPath), string(normalized.Config), normalized.CreatedAt.Unix(), normalized.UpdatedAt.Unix()); err != nil {
+			return fmt.Errorf("upsert guardrail %q: %w", normalized.Name, err)
+		}
+	}
+	if err := tx.Commit(); err != nil {
+		return fmt.Errorf("commit guardrail upsert transaction: %w", err)
+	}
+	return nil
+}
+
+func (s *SQLiteStore) Delete(ctx context.Context, name string) error {
+	result, err := s.db.ExecContext(ctx, `DELETE FROM guardrail_definitions WHERE name = ?`, normalizeDefinitionName(name))
+	if err != nil {
+		return fmt.Errorf("delete guardrail: %w", err)
+	}
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("delete guardrail rows affected: %w", err)
+	}
+	if rowsAffected == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+func (s *SQLiteStore) Close() error {
+	return nil
+}
+
+func scanSQLiteDefinition(scanner definitionScanner) (Definition, error) {
+	var (
+		definition    Definition
+		userPath      sql.NullString
+		configJSON    string
+		createdAtUnix int64
+		updatedAtUnix int64
+	)
+	if err := scanner.Scan(
+		&definition.Name,
+		&definition.Type,
+		&definition.Description,
+		&userPath,
+		&configJSON,
+		&createdAtUnix,
+		&updatedAtUnix,
+	); err != nil {
+		return Definition{}, err
+	}
+	definition.UserPath = nullableStringValue(userPath)
+	definition.Config = append([]byte(nil), configJSON...)
+	definition.CreatedAt = time.Unix(createdAtUnix, 0).UTC()
+	definition.UpdatedAt = time.Unix(updatedAtUnix, 0).UTC()
+	return definition, nil
+}
+
+func isSQLiteDuplicateColumnError(err error) bool {
+	if err == nil {
+		return false
+	}
+	message := strings.ToLower(err.Error())
+	if strings.Contains(message, "duplicate column") || strings.Contains(message, "duplicate column name") {
+		return true
+	}
+	return strings.Contains(message, "already exists") && strings.Contains(message, "column")
+}
diff --git a/internal/guardrails/store_sqlite_test.go b/internal/guardrails/store_sqlite_test.go
new file mode 100644
index 00000000..ebb906a3
--- /dev/null
+++ b/internal/guardrails/store_sqlite_test.go
@@ -0,0 +1,123 @@
+package guardrails
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestNewSQLiteStore_AddsMissingUserPathColumn(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	defer db.Close()
+
+	_, err = db.Exec(`
+		CREATE TABLE guardrail_definitions (
+			name TEXT PRIMARY KEY,
+			type TEXT NOT NULL,
+			description TEXT NOT NULL DEFAULT '',
+			config JSON NOT NULL,
+			created_at INTEGER NOT NULL,
+			updated_at INTEGER NOT NULL
+		)
+	`)
+	if err != nil {
+		t.Fatalf("create guardrail_definitions table: %v", err)
+	}
+
+	store, err := NewSQLiteStore(context.Background(), db)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore() error = %v", err)
+	}
+	if store == nil {
+		t.Fatal("NewSQLiteStore() = nil, want store")
+	}
+
+	rows, err := db.Query(`PRAGMA table_info('guardrail_definitions')`)
+	if err != nil {
+		t.Fatalf("PRAGMA table_info() error = %v", err)
+	}
+	defer rows.Close()
+
+	hasUserPathColumn := false
+	for rows.Next() {
+		var cid int
+		var name string
+		var columnType string
+		var notNull int
+		var defaultValue sql.NullString
+		var primaryKey int
+		if err := rows.Scan(&cid, &name, &columnType, &notNull, &defaultValue, &primaryKey); err != nil {
+			t.Fatalf("rows.Scan() error = %v", err)
+		}
+		if name == "user_path" {
+			hasUserPathColumn = true
+		}
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("rows.Err() = %v", err)
+	}
+	if !hasUserPathColumn {
+		t.Fatal("user_path column missing after initialization")
+	}
+}
+
+func TestSQLiteStore_UpsertAndListRoundTripsUserPath(t *testing.T) {
+	t.Parallel()
+
+	db, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("sql.Open() error = %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	defer db.Close()
+
+	store, err := NewSQLiteStore(context.Background(), db)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore() error = %v", err)
+	}
+
+	err = store.Upsert(context.Background(), Definition{
+		Name:        "policy-system",
+		Type:        "system_prompt",
+		Description: "Default policy",
+		UserPath:    "/team/alpha",
+		Config:      rawConfig(t, map[string]any{"mode": "inject", "content": "be careful"}),
+	})
+	if err != nil {
+		t.Fatalf("Upsert() error = %v", err)
+	}
+
+	definitions, err := store.List(context.Background())
+	if err != nil {
+		t.Fatalf("List() error = %v", err)
+	}
+	if len(definitions) != 1 {
+		t.Fatalf("len(definitions) = %d, want 1", len(definitions))
+	}
+	if definitions[0].UserPath != "/team/alpha" {
+		t.Fatalf("definitions[0].UserPath = %q, want /team/alpha", definitions[0].UserPath)
+	}
+}
+
+func TestIsSQLiteDuplicateColumnError_RequiresColumnContext(t *testing.T) {
+	t.Parallel()
+
+	if !isSQLiteDuplicateColumnError(errors.New("duplicate column name: user_path")) {
+		t.Fatal("isSQLiteDuplicateColumnError() = false, want true for duplicate column")
+	}
+	if !isSQLiteDuplicateColumnError(errors.New("column user_path already exists")) {
+		t.Fatal("isSQLiteDuplicateColumnError() = false, want true for existing column")
+	}
+	if isSQLiteDuplicateColumnError(errors.New("table guardrail_definitions already exists")) {
+		t.Fatal("isSQLiteDuplicateColumnError() = true, want false for non-column already exists")
+	}
+}
diff --git a/internal/guardrails/system_prompt.go b/internal/guardrails/system_prompt.go
index f3d4bf6e..5a8e1ecb 100644
--- a/internal/guardrails/system_prompt.go
+++ b/internal/guardrails/system_prompt.go
@@ -3,6 +3,7 @@ package guardrails
 import (
 	"context"
 	"fmt"
+	"strings"
 )
 
 // SystemPromptMode defines how the system prompt guardrail modifies messages.
@@ -50,6 +51,23 @@ func NewSystemPromptGuardrail(name string, mode SystemPromptMode, content string
 	}, nil
 }
 
+func effectiveSystemPromptMode(mode string) string {
+	resolved := SystemPromptMode(strings.TrimSpace(mode))
+	if resolved == "" {
+		return string(SystemPromptInject)
+	}
+	return string(resolved)
+}
+
+func isValidSystemPromptMode(mode string) bool {
+	switch SystemPromptMode(strings.TrimSpace(mode)) {
+	case SystemPromptInject, SystemPromptOverride, SystemPromptDecorator:
+		return true
+	default:
+		return false
+	}
+}
+
 // Name returns this instance's name.
 func (g *SystemPromptGuardrail) Name() string {
 	return g.name
diff --git a/internal/server/http.go b/internal/server/http.go
index fb86fee8..6186c2dc 100644
--- a/internal/server/http.go
+++ b/internal/server/http.go
@@ -292,6 +292,10 @@ func New(provider core.RoutableProvider, cfg *Config) *Server {
 		adminAPI.GET("/aliases", cfg.AdminHandler.ListAliases)
 		adminAPI.PUT("/aliases/:name", cfg.AdminHandler.UpsertAlias)
 		adminAPI.DELETE("/aliases/:name", cfg.AdminHandler.DeleteAlias)
+		adminAPI.GET("/guardrails/types", cfg.AdminHandler.ListGuardrailTypes)
+		adminAPI.GET("/guardrails", cfg.AdminHandler.ListGuardrails)
+		adminAPI.PUT("/guardrails/:name", cfg.AdminHandler.UpsertGuardrail)
+		adminAPI.DELETE("/guardrails/:name", cfg.AdminHandler.DeleteGuardrail)
 		adminAPI.GET("/execution-plans", cfg.AdminHandler.ListExecutionPlans)
 		adminAPI.GET("/execution-plans/guardrails", cfg.AdminHandler.ListExecutionPlanGuardrails)
 		adminAPI.GET("/execution-plans/:id", cfg.AdminHandler.GetExecutionPlan)