Guardrails
Checks applied to the incoming message before the model and to the answer before your user, saved with the agent version and recorded in the trace.
Guardrails are set per agent on the Guardrails tab of the agent page, and saved with the agent version like the rest of its configuration: a run applies the guardrails of the version it was created from. Each decision is recorded in the run's trace as a guardrail.evaluated event. A message or an answer that is blocked ends the run with the status refused and the agent's refusal message, never with the model's text. On the public API, a message refused by a deterministic input guardrail is rejected with a 400 error (GUARDRAIL_BLOCKED) before any run is created.
There are 2 kinds of guardrails:
- Deterministic: plain functions, with no model call and no network access.
- Model-backed: a chat model acts as the judge. By default it is the agent's own model; Guardrail model lets you choose a smaller, faster one. These calls are metered like any other model call.
Input
Applied to the user's message before the model is called.
| Guardrail | Kind | What it does |
|---|---|---|
| Max input size | Deterministic | Refuses a message longer than the number of characters you set (100,000 at most). |
| Prompt anti-injection | Pattern, then model | Blocks an attempt to override the agent's instructions. The pattern check still gives a verdict when no judge model is available. |
| Forbidden topics | Model | Refuses messages about the topics you list (50 at most). |
| Input PII detection | Deterministic | Detects an e-mail address, a phone number, a card number or an IBAN in the message and flags it in the trace. The message is still processed: nothing is redacted or blocked. |
Output
Applied to the answer before your user receives it.
| Guardrail | Kind | What it does |
|---|---|---|
| Output token cap | Deterministic | A hard limit on the tokens the model may generate. |
| Forbidden patterns | Deterministic | Text or regular expressions that must never leave. The answer is checked sentence by sentence while it streams; on a match, generation stops and the refusal message replaces the answer. |
| Toxicity filter | Model | Blocks offensive or dangerous content. |
| System prompt protection | Pattern, then model | Blocks an answer that discloses the agent's instructions. |
| Schema validation | Deterministic | Checks a structured answer against the agent's output schemas. |
Model-backed output guardrails judge the final answer once it has streamed. When they block it, the text already displayed is withdrawn and replaced by the refusal message.
Behavior
- Response scope refuses a request that clearly falls outside the scope set by the agent's instructions. A judge model compares the incoming message with the first 4,000 characters of the instructions, and lets ordinary conversation, such as a greeting, through.
- Custom refusal message is what your user receives whenever a guardrail refuses, instead of the generic message.
The same tab also holds the spending ceilings of a run, described in Budgets and quotas.
Presets and judge failures
Preset (strict, standard, permissive) switches a set of guardrails on in one click. It also decides what a model-backed guardrail does when its judge fails: provider unavailable, unreadable answer, or no chat model available to act as judge.
| Preset | Time given to each judge | When the judge fails |
|---|---|---|
| strict | 8 s | The message or the answer is blocked. |
| standard | 6 s | It goes through, flagged in the trace. |
| permissive | 4 s | It goes through, flagged in the trace. |
On input, a judge that runs out of time blocks the message whatever the preset. The time limit and this behavior can be changed per agent with the GUARDRAIL_INPUT_TIMEOUT_MS and GUARDRAIL_INPUT_ON_TIMEOUT variables. Letting the message through is then still flagged in the trace, so a message the judge cleared can be told from one it never saw.
A widget on a public site is reachable by anyone, and anything it retrieves may have been written by anyone: that is the combination indirect prompt injection needs. Guardrails lower the odds; they cannot undo what a convinced model does with its tools. For such an agent, turn on Served to unauthenticated users on the Config tab. Its runs then no longer receive the Browser or any remote MCP server, and the workspace loses run_python and run_command, whatever the agent's grants say. Each removal is recorded in the run. The organization's HTTP tools are kept: an HTTP tool with a side effect can still be misused, and only its author can judge whether that matters.
Untrusted content
Independently of guardrails, what the agent did not receive from its user is framed as untrusted data before it enters the prompt: attachments, knowledge extracts, the output of HTTP, MCP and knowledge tools, and the descriptions of third-party MCP tools. Framing is done in one place for the whole platform, and the framed content cannot write the closing marker of its own frame. A scan also flags suspicious phrasing in the trace, without ever blocking: a legitimate document can contain it.
Tests and publication gates
Test suites replay a set of cases against an agent version and score the answers. In the Enterprise edition, a publication gate refuses to publish a version whose suites score below their threshold. See Enterprise license.