Guardrails

Guardrails screen model input, output, retrieved chunks, memory, persona text, and tool arguments at their governed entry points. Policies are layered:

platform baseline + organization override + optional agent policy

Lower layers may tighten policy but cannot weaken the platform baseline.

Available checks

Configured actions are:

allow is a runtime decision, not a configurable enforcement action.

Platform baseline

GET /v1/admin/guardrails/baseline
PUT /v1/admin/guardrails/baseline

Example policy fragment:

{
  "checks": {
    "safety": {
      "enabled": true,
      "action": "block",
      "categories": ["hate", "violence", "sexual", "self_harm"],
      "threshold": "medium"
    },
    "pii": {
      "enabled": true,
      "action": "redact",
      "entities": ["email", "phone", "credit_card", "iban", "ssn"]
    },
    "injection": {
      "enabled": true,
      "action": "monitor"
    }
  }
}

Read the current resource first and preserve its version/conditional-update contract when writing. Policy changes are audited.

Organization policy

Platform operators can manage a specific organization:

GET /v1/admin/orgs/{org_id}/guardrails
PUT /v1/admin/orgs/{org_id}/guardrails

Organization administrators manage their own override:

GET /v1/guardrails
PUT /v1/guardrails
GET /v1/guardrails/effective

The effective endpoint is the best way to verify that an override tightens the baseline as intended.

Provision the classifier

Safety classification can be supplied by a kind: "guardrail" connector or an environment-configured compatible endpoint. A registered connector takes precedence.

With no classifier provisioned, classifier-backed screening is off. Once a classifier is registered, its failure returns 503 for affected calls instead of silently allowing unscreened content.

Deterministic PII, topic, and injection checks still follow their configured policies.

Retrieval and agent behavior

• retrieved chunks with prompt-injection findings are discarded even when the policy action is monitor;
• an agent policy is additively screened around every governed turn;
• blocked tool arguments are never executed;
• guardrail events contain check/category summaries, not the screened content;
• mid-stream blocking does not emit a false clean terminal event.

Test policies with representative safe, unsafe, multilingual, and adversarial examples before enforcement. Start new classifier-based policies in monitor mode, inspect audit results, then move to redact or block with an explicit change record.