Guardrail runtime and limits

Manipulation checks input before the conversation router. Content and Custom rules evaluate all customer-facing output through one Guardrail gate, including Agent, Procedure, Tool-follow-up, and deterministic Say output.

Streaming, blocking, and retry#

Enabled output evaluators run concurrently but their decisions stay in configuration order. If any enabled evaluator is Blocking, the whole response is held until all decisions finish. With only Streaming evaluators, a prefix may already be visible when a violation arrives. That prefix remains in the transcript and cannot be retracted; Operade flags it and ends the conversation.

Retry is possible only when output has not been sent and every triggered rule requests Retry. Operade allows up to three retries. A retry regenerates without Tool access and does not rerun Tools or repeat their external side effects. Deterministic Say output cannot be regenerated, so it ends instead.

Any evaluator error is fail closed: the conversation fails rather than allowing unchecked output. Each evaluator has a 60 seconds timeout and a small bounded output schema.

Limits, model usage, and cost#

No more than 10 active Custom rules can run in one context, counted across Agent and active Procedure; duplicate IDs across those two locations are still evaluated separately. Custom history includes recent user and assistant messages, excludes Tool content, and is trimmed to model context limits.

Manipulation and Content use the fixed Guardrail model. Custom uses its configured active model. Every evaluator model request consumes tokens, records cost, and counts toward workspace quota. Focus adds no evaluator request or cost.

Safe Activity records#

Blocked decisions create guardrail_triggered; evaluator failures create a Guardrail error event. Conversation detail Activity shows safe fields such as type, category or name, mode, action, outcome, model, stage, and error type. Internal prompts, provider reasons, blocked response text, and Secret values are not included.

When a rule triggers unexpectedly, reproduce it in Test chat, compare mode and threshold, and narrow the Custom prompt. Return to Guardrail configuration for placement and field rules.