When you ask the AI to “organize the customer email list”, there’s a real risk of personal information being exposed or leaked. Guardrails automatically validate AI conversation inputs and outputs to prevent these risks.
If the LLM Judge fails to make a decision or returns an unclear response, it defaults to PASS. This is by design to prevent excessive blocking from disrupting normal conversations.
How output guardrails work
After the AI response finishes streaming, the entire response is re-checked. When a violation is detected, the frontend message is automatically replaced with the processed content.
What happens with multiple guardrails?
When multiple guardrails are connected to an agent, all must pass sequentially. If any one blocks, the message is blocked.
Are tool execution results scanned?
No. SQL query results, Knowledge Base search results, etc. — tool execution results are excluded from guardrail scanning. This is by design to prevent false positives on internal data IP addresses or numeric patterns.
You are a content reviewer. Determine whether the following message complies with corporate security policy.## Block when- Requests for confidential info (financial data, personnel info, etc.)- Questions about system hacking or security bypass- Requests for illegal or unethical actions## Allow when- General work questions- Inquiries about public info- Product/service questionsReturn "PASS" if appropriate, "BLOCK" if not.
LLM Judge introduces additional LLM calls, increasing response time. For performance-sensitive cases, use rule-based detection only or pick a fast model as the Judge.
Guardrails can be directly connected via two paths — the agent level and group level — and together with the admin-configured global guardrails, all applied guardrails are merged and run sequentially.
In Workspace > Agents, open the target agent’s edit screen.
2
Pick guardrails
In the Guardrails section, choose guardrails to apply.
You can apply multiple guardrails to one agent — all must pass sequentially before the message is processed.
3
Save
Save the agent settings. The guardrails apply to all conversations with this agent thereafter.
New feature — Setting a guardrail at the group level auto-applies to all conversations of users in that group, even when the agent has no guardrail.
In the Admin Panel > Users > Groups and Permissions tab, select the group to edit. When the Edit User Group modal opens, pick the guardrail to apply under Chat Guardrail.
Item
Description
Applied to
All users in the group
Scope
All conversations of those users (regardless of agent)
When a user chats, guardrails from these 3 paths are all merged and applied:
1. Agent level — Guardrails directly connected to the agent2. Group level — Guardrails of groups the user belongs to3. Global — Guardrails set in admin settings
When the same guardrail is set in multiple paths, it is not executed twice (auto-deduplication). Guardrails selected at group level are removed from the global guardrail selection list to prevent duplicate setup.
The LLM-based guardrail’s detection model selector does not include agents or flows — guardrails can only use plain LLM models. To build guardrail detection with an agent, implement it via separate guardrail patterns (keyword/regex/LLM prompt).
A separate security check on uploaded files. Independent from chat guardrails — automatically runs 4 stages of checks when a file is uploaded.Configure in the Admin Panel > Settings > Guardrails tab.
The LLM analyzes document content and auto-classifies sensitivity. Default categories:
Classification
Default Action
Description
PUBLIC
Allow
Documents that can be public
INTERNAL
Allow
Internal documents
CONFIDENTIAL
Warn (Flag)
Confidential — allow upload but log
RESTRICTED
Block
Top secret — block upload
For large documents, only beginning/middle/end portions are sampled (max 8,000 characters) and passed to the LLM. Since the entire document isn’t analyzed, classification can be inaccurate if key sensitive info is concentrated in a specific section.
Click a log entry to view details (original content, processed content, detection time, etc.). Use the Trace button to see the full processing context for that message.
