Guardrails overview and configuration

Guardrails add bounded safety checks around an Agent. Configure them in Agent Studio, test representative allowed and blocked responses, and publish the branch only after the intended behavior is visible.

Four Guardrail groups#

• Focus strengthens the Agent system instructions so it stays on its defined goal. It does not call an evaluator model, create a Guardrail event, or add evaluator cost.
• Manipulation is the Prompt Injection input check. It evaluates the customer message before routing, Procedures, Tools, or the main Agent call and ends the conversation when blocked.
• Content evaluates seven categories: Sexual, Violence, Harassment, Self Harm, Profanity, Politics and religion, and Medical and Legal Information. Each category can be enabled with a low, medium, or high confidence threshold.
• Custom evaluates an instruction written by your team. Custom rules can be configured on the Agent and on Free-form or Structured Procedures.

Focus, Manipulation, and Content live at Agent level. Procedures inherit those built-ins and may add only Custom rules for their active context.

Configure output evaluation#

Content and Custom rules choose Streaming or Blocking execution. Streaming is faster but may expose a prefix before evaluation finishes. Blocking buffers the response until all enabled output checks complete. The Retry action is available only in Blocking mode and requires feedback; otherwise choose End conversation.

A Custom rule needs a unique ID, name, prompt, active model, execution mode, action, and conversation-history count from 0 to 100. The model picker lists only models with an active adapter and shows their current input and output prices. Up to 10 active Custom rules may run together for the Agent plus the active Procedure.

Draft and test#

Guardrail drawers edit a copy: Cancel discards changes and Done commits them to the draft. Incomplete Custom rules can remain as draft readiness errors, but Publish and Test chat require valid fields and resources.

Use Test chat for allow, block, evaluator-error, and retry cases. Then read runtime and limits before choosing Streaming for a customer-facing text channel.