Skip to main content
Guardrails are in Alpha. The configuration surface described here is live in the agent editor today; enforcement behavior may continue to change while the feature stabilizes.
Guardrails let you constrain what an agent can say and do during live conversations. You configure them per agent, on the Guardrails tab of the agent editor, and they ride the same draft → publish pipeline as the rest of the agent configuration — a guardrail change is saved to your draft and takes effect when you publish.

​
Overview

There are four guardrail types, each shown as a card on the Guardrails tab: Each card shows whether the guardrail is currently active. Click a card to configure it.

​
Focus and Manipulation

Both are single on/off guardrails.
  • Focus reinforces the agent’s system prompt so responses stay aligned with its stated purpose.
  • Manipulation detects and blocks prompt-injection and jailbreak attempts aimed at making the agent ignore its instructions.

​
Content

The Content guardrail moderates conversations across these categories: sexual, violence, harassment, self-harm, profanity, politics and religion, and medical and legal advice. Enable the categories you want to moderate; use Enable all / Disable all to set them in bulk. Each enabled category has a confidence threshold:
  • Low — strictest. Blocks on weaker signals.
  • Medium — balanced (default).
  • High — most lenient. Blocks only on strong signals.
Two settings apply to the Content guardrail as a whole:
  • Execution mode — Streaming evaluates alongside generation for lower latency; Blocking withholds the response until the check passes.
  • Action on violation — End conversation ends the call when the guardrail triggers. Retry regenerates the response and is available only in blocking mode.

​
Custom guardrails

A custom guardrail blocks content that matches criteria you define. Add one or more, each with:
  • Name — a short, descriptive label.
  • Prompt — a natural-language description of what to block. Be specific about the topics or responses to prevent.
  • Model — the lightweight model used to evaluate each turn.
  • Execution mode and Action on violation — the same options as the Content guardrail.
  • Retry feedback — when the action is Retry, optional guidance the agent uses to regenerate a blocked response.
Custom guardrails can be individually enabled or disabled without deleting them.

​
Publishing

Guardrail changes are saved to your draft as you edit. Publish the agent to make them take effect on live conversations. See Versioning for how drafts and versions work.