Keep your Guardrails node, and add custom rules written as SQL or PL/SQL functions that run before every tool call. Examples: block DELETE statements, block queries that return more than 10,000 rows, mask certain columns. Log each call (input, output, user) to a table you can query with SQL.
Oracle angle for it: Run the SQL tool as the end user, so Virtual Private Database and Data Redaction apply to agents the same way they apply to people. This is a strong point for Oracle.
