Guardrails (GUARDRAILS)

Lets an AI model check a text for problems — for example attacks, personal data or the wrong tone — and continues on Pass or on Fail. Use it before an Agent to check what the user sends, or after it to check the answer.

Category: Flow Control · Deployed: yes · Tool-capable: no

Ports

Port Kind Purpose

Input (in_value)

Input

The text to check — the result of the previous module

Pass (out_pass)

Output

Runs when the text passes the check

Fail (out_fail)

Output

Runs when the text breaks a rule, or when the check could not run

Properties

Field Required Meaning

Model Provider (model.provider)

Yes

OLLAMA, OPEN_AI, ANTHROPIC or GEMINI. Easiest: click Select AI Server & Model, which fills in all model fields

Model Name (model.name)

Yes

The model that does the check, for example llama-guard3 or gpt-4o-mini. A small, fast model is usually enough

Model URL (model.url)

Yes

The address of the model server, for example localhost:11434. The designer needs a value for every provider. localhost and 127.0.0.1 are changed to host.docker.internal when the pipeline is sent to the agent

API Key (model.apiKey)

No

Needed for OPEN_AI, ANTHROPIC and GEMINI. Leave it empty for OLLAMA. It is not included when you export the pipeline

Model Timeout (min) (model.timeoutMinutes)

No

How long to wait for the model, 1–120 minutes. The field is filled with 20. If the model takes longer, the check counts as failed and the text goes to Fail

Guardrail Checks (checks)

Yes

What to check for. Choose at least one check from the list below

Custom Guardrail Description (description)

No

An extra rule in your own words, for example "only questions about our products are allowed". The model checks it together with the selected checks

Heuristic Detection Threshold (threshold)

No

How sure the model must be that a rule is broken before the text goes to Fail, 0.0–1.0. Empty means 0.5

Heuristic Detection Threshold in detail. The model rates each text with a number from 0.0 (surely fine) to 1.0 (surely breaks a rule). When the number reaches the threshold, the text goes to Fail.

  • Lower → stricter. More texts are stopped, also harmless ones. At 0.0, every text goes to Fail.

  • Higher → more lenient. Fewer false alarms, but more problems get through.

Test the value with real messages from your users before you rely on it.

The available checks

Each check is shown with its group in front, for example [INPUT] Prompt Injection / Jailbreak Detection. Input checks are meant for what the user sends. Output checks are meant for the agent’s answer.

The model sees only the incoming text — not the rest of the conversation, not the question, and not the documents an answer was based on. Choose checks that can be judged from that text alone.

Input checks — check what the user sends

Check What it finds

Prompt Injection / Jailbreak Detection

Attempts to make the AI ignore its rules, for example "forget your instructions and act as …", hidden (encoded) commands or role-play tricks

PII Detection (Privacy)

Personal data such as names, e-mail addresses, phone numbers, IBANs or IP addresses. It only finds them and sends the text to Fail — it does not remove or hide them

Toxicity & Hate Speech

Insults, threats, hate speech or sexual content

Off-Topic / Scope Control

Requests outside the agent’s area, for example a recipe question to an HR assistant. Describe the area in Custom Guardrail Description — the model does not know it otherwise

Anomaly & Denial-of-Service Protection

Extremely long, repetitive or meaningless input meant to overload the system or drive up costs

Tokens / Password Detection

Passwords, API keys or other secrets that were included by mistake

Output checks — check the answer

Check What it finds

Groundedness / Faithfulness (RAG Check)

Claims that the sources do not support (invented facts). Works only when the sources are part of the checked text

Context Relevance

Answers that miss the question. Works only when the question is part of the checked text

Secret / IP Protection (Leakage Prevention)

Answers that reveal internal things, for example the agent’s own instructions, internal keys or source code

Tonality & Brand Voice

Answers whose tone does not fit. Describe your style in Custom Guardrail Description for best results

Competitor Mention Filter

Answers that mention or promote competitors. Name your competitors in Custom Guardrail Description

Result

Both outputs pass on a short JSON result, not the plain text:

Field Meaning

verdict

PASS or FAIL

score

The model’s rating from 0.0 to 1.0

threshold

The threshold that was used

checks

The selected checks

violatedChecks

The checks the model saw broken

reasoning

A one-sentence reason from the model

value

The checked text

To pass on only the checked text, put a Template with {{value}} after the Guardrails module.

An empty text is not sent to the model. It counts as fine (rating 0.0).

When the check cannot run

Sometimes the model gives no usable answer: it cannot be reached, it takes longer than the Model Timeout, it answers with an error, or its answer has no readable rating. Then the text goes to Fail. The reason in the result says that the check could not run. The agent’s logs and DEV reports show it too.

So a model that is down blocks every text. Test the model connection before you rely on this module.

Use cases

  • Input check: Chat Input → Guardrails → Pass → Agent. Requests that break a rule never reach the agent.

  • Answer check: Agent → Guardrails → Pass → Chat Output. The answer is checked before the user sees it.

  • Both, for anything that users outside your team can reach.

  • Your own rules with Custom Guardrail Description, for example "no questions about the salary of a single person".

Notes

  • Connect Fail to something. For example a Template with a short refusal → Chat Output. If nothing is connected to Fail, the run just stops after the check, and the user is not told why.

  • Match the checks to the position. An input check after the agent, or an output check before it, costs a model call and finds nothing.

  • Every Guardrails module costs one model call per run. Checking both the question and the answer means two extra calls. A small, fast model keeps this cheap.

  • For a check by a fixed rule or a script, without a model, use Validator.