AI Guardrails

AI Guardrails are tool call rules written as a plain-English instruction, such as “any information about Project Alpha, including code names, timelines, or team members”. Use them for topics with no recognizable shape. For data with a pattern, use Standard Entity Rules or Custom Regex Rules.

For prompts and completions sent to a model, see Model guardrails.

How evaluation works

An evaluator answers yes or no for each guardrail independently. On yes, the guardrail’s action fires. When unsure, it answers no.

Pass	When it runs	What it reads
Pre-run	Before the request leaves Workforce	Tool arguments
Post-run	Before the result reaches the client	Tool result

If the evaluator returns no verdict, the call continues and the guardrail is marked as an evaluation failure.

Settings

Configure guardrails at Security → AI guardrails. Templates can prefill every field.

Setting	What it does
Name	Unique per organization, case-insensitive
What should this guardrail catch?	The instruction the evaluator checks
Action	Block or Log
What it screens	Requests (pre-run), responses (post-run), or both
Limit to tool packs	Off by default: applies to every Tool Pack
Limit to user groups	Off by default: applies to every employee. Needs SCIM.
Enabled	Turns the guardrail on or off

Nothing is screened until you add your first guardrail.

Tool Pack limits skip the employee MCP endpoint

Calls through the employee MCP endpoint have no Tool Pack, so they match only guardrails with Limit to tool packs off.

Actions

Action	What happens
Block	The call is canceled. The client gets an error starting with `Blocked by guardrail rule:` and the call is logged as a failure in Tool call logs.
Log	The call proceeds and the verdict is recorded

Write a good instruction

Cover one subject per guardrail.
Name the subject and the forms it takes, such as code names.
Screen requests for data that must not leave. Screen responses for data an agent must not pull in. Both costs two evaluations per call.

Examples

Name:         Block Project Alpha
Instruction:  Any information about Project Alpha, including code names,
              timelines, or team members
Action:       Block
Screens:      Requests and responses

Name:         Leaked credentials
Instruction:  API keys, passwords, tokens, or other secrets appearing in
              tool responses
Action:       Log
Screens:      Responses

Evaluation model class

Set a class for pre-run and post-run separately on the AI guardrails tab.

Class	Trade-off
Fast	Quickest and cheapest. Enough for most instructions.
Balanced	More accurate on nuanced instructions, a little slower
Thorough	Best on subtle content, slowest

A common split is Fast for pre-run, since employees feel that latency, and Balanced for post-run.

Next: test a guardrail in the Guardrail tester.