Stringly-Typed Guardrails: how agent safety checks fail by matching the wrong thing