agent-guardrails

     /// The new SpendTracker PDA linked to the new policy.    #[account(        init,        payer = owner,        space = SPEND_TRACKER_SIZE,        seeds = [b"tracker", new_policy.key().as_ref()],        bump,    )]    pub new_tracker: Account<'info, SpendTracker>,     pub system_program: Program<'info, System>,} // ---------------------------------------------------------------------------// Handler// --------------------------------------------------------------------------- pub fn handler(ctx: Context<RotateAgentKey>, args: RotateAgentKeyArgs) -> Result<()> {    let clock = Clock::get()?;     // 1. Validate: new agent must differ from current    require!(        args.new_agent != ctx.accounts.old_policy.agent,

1. Line 76 init,: Creates and pays for a new account. Space and payer must be specified.
2. Line 79 seeds = [b"tracker", new_policy.key().as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
3. Line 80 bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
4. Line 92 let clock = Clock::get()?;: Reads on-chain time from the Clock sysvar.
5. Line 95 require!(: An explicit validation that aborts the instruction with an error.

use crate::errors::GuardrailsError;use crate::state::policy::{PermissionPolicy, MAX_ALLOWED_PROGRAMS, MAX_AUTHORIZED_MONITORS}; // ---------------------------------------------------------------------------// Accounts// --------------------------------------------------------------------------- #[derive(Accounts)]pub struct UpdatePolicy<'info> {    /// The policy owner. Must sign. The `has_one` constraint on `policy`    /// verifies that this signer matches the stored `policy.owner`.    pub owner: Signer<'info>,     /// The PermissionPolicy PDA to update. Only the stored owner can modify it.    /// The `has_one = owner` constraint enforces ownership — Anchor checks    /// `policy.owner == owner.key()` and returns ConstraintHasOne on mismatch.    #[account(        mut,        seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],        bump = policy.bump,        has_one = owner,    )]    pub policy: Account<'info, PermissionPolicy>,}

1. Line 22 /// The policy owner. Must sign. The `has_one` constraint on `policy`: Checks that a stored pubkey field matches the passed account.
2. Line 24 pub owner: Signer<'info>,: Requires this account to have signed the transaction.
3. Line 31 seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 32 bump = policy.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.

 // ---------------------------------------------------------------------------// Accounts// --------------------------------------------------------------------------- #[derive(Accounts)]pub struct ClosePolicy<'info> {    /// Only the policy owner can close it.    #[account(mut)]    pub owner: Signer<'info>,     /// The PermissionPolicy PDA to close. Must be paused.    #[account(        mut,        seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],        bump = policy.bump,        has_one = owner,    )]    pub policy: Box<Account<'info, PermissionPolicy>>,     /// The SpendTracker PDA to close.    #[account(        mut,        seeds = [b"tracker", policy.key().as_ref()],

1. Line 22 pub owner: Signer<'info>,: Requires this account to have signed the transaction.
2. Line 27 seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
3. Line 28 bump = policy.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.
4. Line 29 has_one = owner,: Checks that a stored pubkey field matches the passed account.

use crate::state::policy::PermissionPolicy; // ---------------------------------------------------------------------------// Accounts// --------------------------------------------------------------------------- #[derive(Accounts)]pub struct PauseAgent<'info> {    /// The caller requesting the pause. Must be either the policy owner or    /// one of the policy's authorized_monitors. Validated in handler body    /// (not via has_one, because monitors are a Vec, not a single field).    pub caller: Signer<'info>,     /// The PermissionPolicy PDA to pause. Mutable because is_active,    /// paused_by, and paused_reason fields are modified.    #[account(        mut,        seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],        bump = policy.bump,    )]    pub policy: Account<'info, PermissionPolicy>,} // ---------------------------------------------------------------------------

1. Line 23 /// (not via has_one, because monitors are a Vec, not a single field).: Checks that a stored pubkey field matches the passed account.
2. Line 24 pub caller: Signer<'info>,: Requires this account to have signed the transaction.
3. Line 30 seeds = [b"policy", policy.owner.as_ref(), policy.agent.as_ref()],: Declares the PDA seeds. Anchor re-derives the address and rejects the account if it doesn't match.
4. Line 31 bump = policy.bump,: Uses the bump seed, the extra byte that pushes the derived address off the ed25519 curve.