Guardrails
Enable and configure enterprise-wide safety checks on user input and agent output.
Open Administration → Guardrails from the Solutions sidebar (Enterprise Admin role required).
Guardrails inspect user input, agent output, or both, then take an action when a check fails — for example redacting an email address, blocking a jailbreak prompt, or asking the model to try again.
| Guardrail | What it checks |
|---|---|
| PII / Anonymizer | Sensitive data (email, phone, SSN, and similar) |
| Valid JSON | Whether agent output is parseable JSON |
| Competitor Check | Mentions of banned brand names |
| Gibberish | Non-sensical noise that wastes tokens |
| Toxicity | Hate speech, harassment, and profanity |
| Prompt Injection | Jailbreak attempts (e.g. “ignore previous rules”) |
| Hallucination | Whether answers are supported by context (output only) |
The guardrails list
The All tab shows every guardrail available to the enterprise. Each card has:
- A name and short description
- An enable toggle — turn a guardrail on or off without opening it
Click a card to open its detail page. If none are available, the page shows an empty state.
Enabling a guardrail and applying enterprise-wide enforcement are separate. The toggle turns the check on; enterprise-wide enforcement pushes its configuration to every agent and locks agent-level edits.
The detail page
The left side explains the guardrail: overview, behavior, capabilities, supported actions, examples, limitations, and how tests report results.
The right side is Configuration. Save applies the form; Cancel restores the last saved values. Unsaved changes keep Save enabled.
At the top of the detail page you can also:
- Enable or disable the guardrail (same as the list toggle)
- See accepted content type — string for most types; string and object for Valid JSON
- See what it currently applies to (input, output, or both)
Shared settings
These appear on every guardrail. Some fields only show after you turn on enterprise-wide enforcement.
Enterprise-wide enforcement
Apply this configuration enterprise-wide pushes the same settings to every agent and locks agent-level editing. Turn it off if builders should configure the guardrail per agent in the App Workspace instead.
When this is off, only the type-specific fields (threshold, banned list, and so on) stay required. Applies to, enforcement mode, and action on fail appear once enterprise-wide enforcement is on.
Applies to
Not every type has this control. When it does:
| Option | What is checked |
|---|---|
| User input only | Messages from the end user |
| Agent output only | Replies from the model |
| Both input & output | User messages and agent replies |
Hallucination checks output only. Valid JSON and Prompt Injection do not show this control — they act on structured agent output and jailbreak-style prompts respectively.
Enforcement mode
| Mode | Behavior |
|---|---|
| Active | Enforce the rules and change or stop the message |
| Shadow | Detect and log, but leave the message unchanged |
Use Shadow first when you want to see how often a check would fire before you block or rewrite live traffic.
Action on fail
What happens when the check trips. The options depend on the guardrail type (tables below).
Guardrail types
PII / Anonymizer
Identifies and anonymizes sensitive data such as email, phone, SSN, IBAN, and credit card numbers. Use it when agents handle customer identity data.
Configure:
- PII entities — types to detect (required; type a value and press Enter)
- Mask strategy — how to hide matched values
- Applies to — input, output, or both
- Action on fail
| Mask strategy | Effect |
|---|---|
| Redact | Replace sensitive data |
| Replace | Replace with placeholders |
| Remove | Delete the sensitive data |
| Action on fail | Effect |
|---|---|
| Detect only | Log PII; leave the message unchanged |
| Redact | Replace with placeholders |
| Remove | Delete the sensitive data |
| Block | Stop the message |
A de-anonymizer can restore true values after the model runs so tools still receive real data. Unusual formats may be missed.
Valid JSON
Ensures agent output is parseable JSON. Use it when agents call tools or APIs.
Configure: enforcement mode and action on fail.
| Action on fail | Effect |
|---|---|
| Fix | Auto-correct minor syntax issues (missing brackets, quotes, commas) |
| Reask | Ask the model to regenerate |
Deep schema checks can add latency.
Competitor Check
Blocks or filters mentions of banned brand names. Use it for branded assistants (airline, telco, banking).
Configure:
- Banned list — competitor names (required; type a value and press Enter)
- Applies to — input, output, or both
- Action on fail — Filter (remove the brand name) or Block
Detection is keyword-based, not semantic. Misspellings such as "Uunited" may not trigger.
Gibberish
Detects unintelligible input so you do not spend tokens on noise (accidental junk, voice-to-text errors, random keystrokes).
Configure:
- Threshold — 0.0 (lenient) to 1.0 (strict)
- Applies to — input, output, or both
- Action on fail — Reask only (ask the model to regenerate)
Code snippets and technical syntax may be flagged.
Toxicity
Checks for hate speech, harassment, profanity, and aggressive language.
Configure:
- Threshold — 0.0 to 1.0
- Validation method — Sentence (each sentence) or Full (the whole message)
- Applies to — input, output, or both
- Action on fail
| Action on fail | When to use it |
|---|---|
| Filter | One toxic phrase; the rest of the message is still usable |
| Reask | Meaning is there, but the wording is too toxic to strip cleanly |
| Block | The whole message is abusive and nothing useful remains |
| Pass | Allow the message unchanged (typically when nothing harmful was found) |
Negative sentiment without abuse (for example disappointment) should pass. Sarcasm and reclaimed slurs may be misclassified.
Prompt Injection
Detects jailbreak attempts such as "ignore previous rules" or "pretend to be DAN", so system instructions stay hidden.
Configure: enforcement mode and action on fail.
| Action on fail | Effect |
|---|---|
| Block | Reject the message |
| Respond directly | Return a safe reply immediately, without calling the model |
New jailbreak patterns appear often; treat this as one layer, not the only one.
Hallucination
Uses NLI to check whether the answer is supported by context. Use it when reliability matters (support, finance, knowledge assistants). This guardrail runs on output only.
Configure:
- Threshold — 0.0 to 1.0
- Chunk strategy
- Action on fail — Block (stop the unsupported answer) or Reask
| Chunk strategy | Strictness |
|---|---|
| Sentence match | Every sentence must be backed by the source. One unverified date fails the whole reply. |
| Paragraph match | The general meaning must match. A summary that misses a minor detail can still pass. |
Embedding comparison adds latency.
Working with agents
Builders attach, configure, and test guardrails on an agent’s Guardrails tab — from the enterprise Agents catalog or an app’s Agents tab. Full steps for adding, editing, deleting, and dry-run testing are in Managing Agents → Guardrails.
When enterprise-wide enforcement is on here, that agent-level editor is locked so every agent uses these administration settings — the UI shows that the enterprise guardrail cannot be edited.
Platform Users can view administration screens but cannot change them.