I built agent_acid: a rollback + guardrail engine that catches AI-agent attacks most safety layers miss

Most AI agent guardrail systems check one tool call at a time, with no memory of the session. That means an attacker (or even a confused AI) can split one large forbidden action into several small, individually-legal-looking ones -- a real, documented pattern called "salami slicing."

I built agent_acid to close that gap:

1. Automatic rollback -- every tool gets a paired "undo" action. If any step in a multi-step AI agent plan fails, everything already done gets undone automatically.

2. Stateful guardrails -- rules that remember the whole session, not just one call. A cumulative limit catches a $1,200 charge split into three $400 calls, even though each one individually passes a per-step check.

I tested this against a live GPT-4o-mini agent actively trying to pull off both attacks (prompt injection and salami-slicing), and against a naive agent with only basic per-step validation. The naive agent got completely fooled -- $1,200 charged, no way to undo it. agent_acid caught it and reversed everything, including deleting the account that had already been created.

It's open source, tested (automated pytest suite, no API key needed), and published:
pip install agent-acid
GitHub: https://github.com/muhammadwaqasai/agent_acid

Built this solo over the past week. Would love feedback from anyone working on AI agents in production, or anyone who wants to try to break it.