> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zeptar.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Guardrails

> Set boundaries for how your agent behaves in production so live conversations stay safe and predictable.

<Note>
  Guardrails are in **Alpha**. The configuration surface described here is live in the agent editor today; enforcement behavior may continue to change while the feature stabilizes.
</Note>

Guardrails let you constrain what an agent can say and do during live conversations. You configure them per agent, on the **Guardrails** tab of the agent editor, and they ride the same draft → publish pipeline as the rest of the agent configuration — a guardrail change is saved to your draft and takes effect when you publish.

## Overview

There are four guardrail types, each shown as a card on the Guardrails tab:

| Guardrail        | What it does                                                                                                            |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Focus**        | Keeps the agent on its defined goal and system instructions, so it doesn't drift off-topic or into unintended behavior. |
| **Manipulation** | Blocks attempts to override or bypass the agent's instructions through prompt injection or jailbreaking.                |
| **Content**      | Blocks unsafe content across a fixed set of categories, each with its own sensitivity.                                  |
| **Custom**       | Blocks content that matches criteria you describe in natural language, evaluated by a lightweight model.                |

Each card shows whether the guardrail is currently active. Click a card to configure it.

## Focus and Manipulation

Both are single on/off guardrails.

* **Focus** reinforces the agent's system prompt so responses stay aligned with its stated purpose.
* **Manipulation** detects and blocks prompt-injection and jailbreak attempts aimed at making the agent ignore its instructions.

## Content

The Content guardrail moderates conversations across these categories: sexual, violence, harassment, self-harm, profanity, politics and religion, and medical and legal advice. Enable the categories you want to moderate; use **Enable all** / **Disable all** to set them in bulk.

Each enabled category has a **confidence threshold**:

* **Low** — strictest. Blocks on weaker signals.
* **Medium** — balanced (default).
* **High** — most lenient. Blocks only on strong signals.

Two settings apply to the Content guardrail as a whole:

* **Execution mode** — `Streaming` evaluates alongside generation for lower latency; `Blocking` withholds the response until the check passes.
* **Action on violation** — `End conversation` ends the call when the guardrail triggers. `Retry` regenerates the response and is available only in blocking mode.

## Custom guardrails

A custom guardrail blocks content that matches criteria you define. Add one or more, each with:

* **Name** — a short, descriptive label.
* **Prompt** — a natural-language description of what to block. Be specific about the topics or responses to prevent.
* **Model** — the lightweight model used to evaluate each turn.
* **Execution mode** and **Action on violation** — the same options as the Content guardrail.
* **Retry feedback** — when the action is `Retry`, optional guidance the agent uses to regenerate a blocked response.

Custom guardrails can be individually enabled or disabled without deleting them.

## Publishing

Guardrail changes are saved to your draft as you edit. Publish the agent to make them take effect on live conversations. See [Versioning](/agents/operate/versioning) for how drafts and versions work.