Guide

Guardrails

A guardrail profile is a set of checks that run on what users send, what tools and documents return, and what the agent answers.

The checks

Check	What it does
PII detection	Finds personal data such as emails, phone numbers and IDs, and masks or blocks it.
Prompt injection	Stops a user's message from overriding the agent's instructions.
Hidden instructions	Finds instructions planted in documents and tool results the agent reads.
Blocked topics	Keeps the conversation away from topics you choose.
Toxicity	Catches abusive, hateful or unsafe content.
Grounding	Checks that an answer is supported by the agent's sources.
Image safety	Screens images for unsafe content.
Goal hijacking	Detects when the agent's reasoning drifts away from the user's task.
Custom pattern	Matches text against patterns you define (for example, redact a phrase).
Custom policy	Applies a rule you write in plain language.

What a check does when it fires

Action	Effect
Block (EXCEPTION)	Stops the turn. On input the model is never called; the user gets a refusal.
Re-ask (REASK)	Asks the model to answer again, aware of the problem, so it writes a contextual decline (once, then a standard message).
Fix (FIX)	Replaces the content with a cleaned version, for example personal data masked.
Log only (NOOP)	Records the finding in the audit trail and lets the content through.

Workspace default and agent profiles

Guardrails > Set Up Guardrails offers three presets. Permissive only logs prompt injection. Balanced (recommended for customer-facing agents) asks the user to rephrase on attacks and toxic content, blocks severe toxicity and watches grounding. Strict adds a second, AI-powered injection check, a stricter grounding check, image safety and goal hijacking. No preset masks personal data or restricts topics: add those per agent. Apply one as the Workspace default (every agent uses it) or as a Custom profile you pick in an agent's Guardrails step. An agent gets the workspace default plus its own profile, and the stricter setting wins: an agent profile can add or tighten checks but never remove or relax the workspace default.

As code

guardrails (DAK, TypeScript)

new GuardrailProfile(stack, 'Baseline', {
  profileName: 'workspace-baseline',
  scope: GuardrailScope.WORKSPACE,          // every agent in the workspace inherits it
  pluginBindings: [
    Guardrail.promptInjection({ action: GuardrailAction.EXCEPTION }),
    Guardrail.piiDetection(),                // masks personal data
    Guardrail.toxicity({ action: GuardrailAction.REASK }),
  ],
});

A profile with scope: GuardrailScope.AGENT is attached with the agent's guardrail prop. Checks declared in code fail closed: if a check itself errors, the content is treated as failing.

See what was blocked

Monitor > Blocked lists the turns a guardrail or policy stopped, and the run shows which check fired. The Audit log records each block with the end user it was for.