Guardrails
Organization guardrail policies for Action Agents: stages, detectors, publish, enforcement, approvals, and violations.
Guardrails
Guardrails are organization policies that screen Action Agent turns. They apply to agents and to agent presets. They do not run on ActionFlow graphs.
A new organization has no guardrail set, and a new agent is not assigned one. Until you create a set, publish it, and assign it, that agent has no organization rules. Nothing in the product inserts a default PII or moderation policy.
REST, the TypeScript SDK, and hosted MCP cannot create, publish, or assign policies. Use Guardrails in the workspace. Public agent metadata does not include the assigned set.
Policy sets
Policies live in named sets. Each set has versioned policies with status draft, published, or archived. Publishing a draft archives the previous published version of that set in the same write. One published version is current.
A global platform set exists. Its slug is platform, it has no organization, and it is not writable. An agent with no assigned set uses that platform set, which carries no organization rules.
Assign a set in Action Agent Studio. Clearing the assignment returns the agent to the platform set. The assignment needs guardrail:write and increments configVersion.
An agent can also store overrides. Overrides may only raise the action, raise the severity, or tighten the rule config. A weaker or identical override is rejected. An agent inherits overrides from its non-deleted preset, then applies its own. A soft-deleted preset's overrides stop applying.
Stages and actions
| Stage | What the runtime screens |
|---|---|
input | The trailing run of user messages, before the model call. The system prompt, skills, and memory are outside this stage. |
retrieval | Knowledge tool results. Knowledge tool arguments are not screened as tool_input. |
tool_input | Arguments for MCP, builtin, database, and named HTTP tools. Named HTTP tools are screened before fetch, in addition to their own URL checks. |
tool_output | Results from those same tools. |
output | Assistant text on the public SSE wire, the OpenAI-compatible SSE wire, the transcript, and non-streaming outbound text. |
artifact | Recognized generated-file candidates, before they are stored. |
Rule actions are warn, redact, require_approval, and block. A clean pass is allow and is not stored as a violation.
Output screening runs only when the published policy has output rules. With no output rules, public text deltas are sent as the model produced them. When output rules exist, the stream holds back the last 512 characters so a match that crosses a chunk boundary is still seen whole.
A block or a redaction the public stream cannot apply becomes the fixed message An error occurred.
require_approval on input, before the provider call, replaces the turn with: "This turn is waiting for a reviewer to approve it under your organization's guardrail policy. Nothing from it was saved, and it continues once the approval is recorded." The same action on retrieval, tool_input, tool_output, output, or artifact fails the turn. The next message in that session re-reads the decision. Approval of policy version N does not release version N+1.
Detectors
Detectors are local pattern checks. They are not a hosted moderation model. Defaults below are the catalog defaults. A published rule can choose a stricter action. A rule action cannot be allow.
| Detector | Default severity | Default action | Timeout | If the detector cannot decide | Stages |
|---|---|---|---|---|---|
pii | high | redact | 250 ms | fail closed | input, retrieval, output, artifact |
secret | critical | block | 250 ms | fail closed | all six |
prompt_injection | high | block | 250 ms | fail closed | input, retrieval, tool_input, output |
indirect_prompt_injection | high | block | 250 ms | fail closed | retrieval, tool_output, artifact |
system_prompt_leakage | high | block | 250 ms | fail closed | output, artifact |
profanity | low | warn | 150 ms | warn | input, retrieval, output |
moderation | high | block | 250 ms | fail closed | input, retrieval, output, artifact |
topic | medium | block | 150 ms | warn | input, retrieval, output |
json_schema | high | block | 250 ms | fail closed | output, artifact |
tool_policy | critical | block | 150 ms | fail closed | tool_input, tool_output |
ssrf | critical | block | 250 ms | fail closed | tool_input |
artifact | high | block | 250 ms | fail closed | artifact |
custom | high | block | 250 ms | fail closed | all six |
network_and_tool | high | block | 250 ms | fail closed | tool_input, tool_output |
PII entities are email, phone, ssn, and creditCard. Redaction markers include [REDACTED_EMAIL], [REDACTED_PHONE], [REDACTED_SSN], and [REDACTED_CREDIT_CARD]. Secret checks cover bearer tokens, API keys, credentials, GitHub tokens, Slack tokens, and private-key blocks. Prompt-injection checks match a fixed phrase list. Moderation checks are short patterns for hate speech, harassment, profanity, self-harm, sexual content, toxicity, and violence.
Text longer than 20,000 characters is uninspectable and fails closed for pattern detectors. A declared pattern may be at most 512 characters. A policy may contain at most 200 rules.
Publish
Publish accepts a draft of that set. high and critical rules need a fresh passing result in the high_risk_fixtures suite, newer than the newest rule change. Low and medium fixture failures do not block publish.
The runtime policy cache TTL is 60 seconds. Publishing a guardrail does not by itself reconnect MCP clients. The guardrail policy version is tracked separately from the MCP fingerprint. See MCP.
Approvals and violations
Guardrail approvals are a separate queue from HITL flow pauses and from Lead Review.
| Item | Current behavior |
|---|---|
| Queue | /approvals/guardrails |
| Statuses | pending, approved, rejected, expired |
| Permission | guardrail:approve |
| Self-approval | Refused |
| Expiry | Optional. A null expiry does not expire. A past expiresAt is marked expired when someone tries to decide it. |
| Summary | Capped at 256 characters |
Violations are stored for decisions other than allow. A row stores the action, stage, rule key, detector key, severity, reason code, policy version, resource, optional run and session ids, latency, and safe metadata. It does not store the prompt, the output, or tool arguments. The violations page is /violations. Queue page size is 25.
Permissions
| Role | Guardrails |
|---|---|
| Owner, Admin | read, write, approve |
| Member | read |
Write covers drafts, publish, archive, assign, overrides, and fixtures. See Organization permissions.