Policy enforcement at runtime. Rule authoring without DSL drama.
Block destructive tool calls. Hold high-risk operations for human approval. Redact PII before it leaves your walls. A rule builder anyone on the team can use — plain-English preview, preset chips, test against real calls before you ship.
Four decisions. One runtime.
Every intercepted call maps to one of these four. Severity decides which wins when rules conflict.
allowCall proceeds. Logged for observability + compliance.
blockCall refused. Reason returned to the agent. Never executes.
holdCall paused awaiting human approval. Long-poll returns the verdict.
redactArguments or output scrubbed before the call proceeds. PII never touches downstream.
A rule builder that explains itself
Plain-English preview updates as you type. Preset chips for common patterns. Advanced JSON escape hatch when you need it.
Preset chips
Block destructive shell. Approval on large refunds. Flag PII detector. Block prompt injection. One click prefills the form.
Plain-English preview
'When a tool call happens, if tool equals shell and args.cmd matches /rm -rf/, block the call.' Updates as you edit.
Test against last 100
Run the drafted rule against the last 100 real calls. See matches, false positives, and what would have happened. Ship with confidence.
Activity → Policy → Activity
Every uncovered row in the Activity Log has a 'Create policy' button. Author the rule inline. The next matching call enforces it.
# Your agent code stays unchanged. The SDK intercepts the call.
result = client.agent.tool_call(
run_uid=run_uid,
tool="shell",
arguments={"cmd": "rm -rf /tmp/important"},
)
if result["decision"] == "block":
raise GuardrailBlocked(result["reason"])
if result["decision"] == "hold":
# Long-poll while a reviewer approves/denies.
final = client.agent.await_decision(
audit_id=result["audit_id"], timeout_ms=30000
)
if final["decision"] != "allow":
raise GuardrailHeld(final["reason"])
# Only now does the actual shell call run.
subprocess.run(result["tool"] + " " + result["arguments"]["cmd"])query_databaseallowcompletedsend_emailblockcompletedissue_refundholdpendingissue_refundallowcompletedupdate_crmallowcompletedfetch_piiblockcompletedDetectors, pre-flight
Four built-in detectors run on every call. Their flags are available to every rule as detector_flags.
Names · emails · SSNs · phone · addresses
API keys · passwords · tokens · PEMs
System-override and jailbreak patterns
Known bypass corpora + heuristics
Guardrails FAQs
Frequently Asked Questions
Stop your agent from doing the wrong thing. Before it does it.
Join the teams shipping safer AI with real-time evaluation, audit trails, and continuous improvement.