Guardrails

A guardrail is one check: what it reads, what it does about a violation, and whether it is in force at all. Settings → Guardrails is where guardrails are defined. Open it with the Settings control in the top navigation bar, then choose Guardrails under Governance in the Settings sidebar.

Each card carries the guardrail's status, its kind, the stage it runs at, and what it does about a violation.

Two pages named Guardrails

The console also has a Guardrails page, and the two do different jobs:

Both list the same guardrails. The console page links here with Edit in Settings whenever you need to change what a control actually does.

What a guardrail is made of

Four choices decide a guardrail's behaviour. Everything else on the form is specific to the kind you chose.

Kind — what it looks for

The kind decides how the check is performed, and which configuration fields the form offers you.

The five deterministic kinds cost no model call. LLM judge is the only kind that reaches a provider, which is why it is the only one that needs a model and a prompt.

Stage — which payload it reads

Action — what it does about a violation

Redact is offered only for the kinds that can return the spans to substitute — PII, Regex deny, Word deny and Secret scan. Link domain and LLM judge return a verdict, not spans, so the form hides Redact when one of those is selected, and steps a chosen Redact back to Block.

Status — whether it is in force

A guardrail is Draft or Active. Only an Active guardrail is evaluated: a draft can be authored, listed and attached to an agent while checking nothing. That is deliberate — it is how you stage a control before it governs anyone — but it also means a plane full of drafts reports coverage it does not have. The page states the count above the list when any guardrail on it is still a draft.

New guardrails are offered as Active.

Create a guardrail

Switching kind mid-edit clears the fields the new kind does not read. The server refuses a field its kind does not use, so the form drops them rather than letting you submit a request that would be rejected for naming a control the form has stopped showing.

Configuration by kind

Word matching

Where a word may appear has two settings, and neither is free:

• Whole words only (the default) does not match inflections. A list containing refund does not catch refunds or refunding. Add the forms you mean.
• Anywhere inside a word catches inflections, and also matches inside unrelated words — a list containing class then refuses an answer that mentions classical or classify. Profanity lists are where this bites hardest, because so many short offensive words are substrings of ordinary ones.

Which error is cheaper depends on your own vocabulary.

Regular expressions

Patterns are Python regular expressions and are validated as you add them. A pattern that repeats a group without a bound — the shape that can stall a turn on a crafted input — is refused at the write boundary, so (?:all |any |your )* will not save.

Link domain needs an allowlist

A Link domain guardrail carries no hosts of its own. Attach it to a subject that also carries an egress allowlist. With no allowlist in force it cannot be evaluated at all, and it stops the turn under its own name rather than passing quietly.

Test a guardrail before it governs anything

Every card has a flask icon, and the editor has a Test button. Both open a drawer that runs a sample payload through that one guardrail exactly as a live turn would. The definition travels by value, so you can test a draft you have not saved yet.

The drawer reports the verdict, why it fired, and what the agent would actually see.

The result has three parts:

• The verdict — Allowed or Blocked, the action taken, and how many spans were redacted.
• Why — every span the detector matched, and every near miss: a candidate that had the right shape and failed the check behind it, such as a card-shaped number that fails its checksum. This is the only place that answers "I pasted something that looks like a card number and it says Allowed".
• What the agent would see — the payload after redaction, the note that nothing changed, or the statement that the turn is refused.

If the guardrail cannot be evaluated at all, the drawer says Could not be evaluated rather than reporting a pass. An unevaluable control is not a clean payload, and a live turn stops there too.

Guardrails that ship with AskRAI

Every tenant is seeded with a catalog of platform guardrails, marked with a Platform badge. They are read-only here: the server refuses an edit or a delete, so the editor shows the fields for inspection and offers no Save.

A platform guardrail is inspectable but not editable — Duplicate & edit is how you change one.

To change a platform guardrail, select Duplicate & edit. The server clones it as an editable tenant copy, and the editor stays open on the copy. The copy is created as a Draft, so review it and set it Active to put it in force.

Seeding a tenant changes no traffic on its own. A platform guardrail governs a turn only once something attaches it — directly, or through a policy.

Find a guardrail

The list shows ten guardrails per page. The search box searches the whole tenant on the server, not just the page you are looking at, so a guardrail on page three is reachable by name. Use the pagination control beneath the list to move between pages.

Edit or delete a guardrail

Select any card to open it. Change what you need and select Save changes; the editor warns you before discarding unsaved edits.

Delete is on the left of the editor footer and asks for confirmation. Deleting is permanent, and the confirmation states the consequence plainly: the guardrail stops governing every agent and group it is attached to.

What the editor refuses

The editor checks a definition before the round trip and names the reason, rather than surfacing an error you have to re-read the form to interpret. Most of these are also refused by the server; the judge-model rule is the editor's own.

An incomplete definition cannot be tested whatever its status: the Test button checks the definition as though it were Active, because a test of a control that could not run answers nothing. A draft may still be saved incomplete — that is what a draft is for.

Field reference

Category and priority are not set here. They belong to the analytics view and are edited on the console Guardrails page.

Guardrails created before the governance plane

A guardrail written before this plane existed carries none of these fields, so it keeps the original behaviour: an LLM judge running at the Input stage that Blocks, and is Active. Those rows appear in this list alongside the rest and can be opened and given a kind, a stage and an action like any other — with one extra step, because an active judge carries no Judge model either: choose one before Save changes will enable.

Related pages