Guardrails

Guardrails asynchronously review user prompts for safety and policy compliance. They are independent of tool approval gates: approvals pause a proposed action for a person, while guardrails classify the user’s request and can cancel active work and replace the visible assistant output for a blocked turn.

Built-in guardrails

ID	Purpose	Cadence
`pii_detection`	Detect personally identifiable, confidential, or sensitive information in the user prompt	Every turn
`adherence_detection`	Detect prompts that are clearly unrelated to the workspace or agent task	First user message
`roost_open_safety`	Apply the configured open-safety policy to the user prompt	First user message

Each tenant setting contains the policy, customer-facing replacement message, review model, enabled state, cadence, and whether the guardrail is available for per-agent assignment. The API also returns the shipped defaults so an administrator can distinguish an override from the default configuration.

Tenant policy and agent assignment

Tenant administrators manage policy with /api/v1/tenant/guardrails. Agent assignment is separate and uses /api/v1/agents/{id}/guardrails. An enabled tenant guardrail runs only for agents to which it is assigned. New sub-agents accept guardrail_ids during creation: omit the field to use the tenant default set, or send [] to assign none. Assignment changes take effect on the next turn.

from agentflow.models import TenantGuardrailUpdate

catalog = await client.settings.list_guardrails()
pii = next(item for item in catalog.guardrails if item.id == "pii_detection")

await client.settings.update_guardrail(
    "pii_detection",
    TenantGuardrailUpdate(
        policy=pii.policy,
        replacement_message="I can't provide that response because it may expose personal information.",
        model=pii.model,
        enabled=True,
    ),
)
await client.agents.guardrails.assign(agent_id, "pii_detection")

Changing a guardrail policy, model, availability, or agent assignment requires tenant-admin permission. Do not put secrets or raw customer data in a policy or replacement message.

Runtime result

A clear verdict leaves the turn unchanged. A blocking verdict cancels the active root call when possible and replaces the persisted visible assistant output with the configured replacement message, provided the guarded user message is still the latest visible turn. Guardrail review metadata is attached to run and conversation surfaces so authorized clients can explain why output was replaced without exposing credentials or hidden prompts. See SDK: Guardrails and the Guardrails API reference.

Getting Started

Core Concepts

Guides

Built-in guardrails

Tenant policy and agent assignment

Runtime result

​Built-in guardrails

​Tenant policy and agent assignment

​Runtime result

Built-in guardrails

Tenant policy and agent assignment

Runtime result