Build

Built-in Guardrails

Configure input and output checks for prompt injection, PII, moderation, topic control, prompt leakage, and data exfiltration.

Last updated August 20, 2026

On this page

Input Guardrails

`prompt_injection`

Checks input for common prompt-injection patterns and obfuscated variants.

agents/agent.yaml

guardrails:
  input:
    - type: prompt_injection
      mode: block
      config:
        sensitivity: high

Config	Description
`sensitivity`	`low` \| `medium` (default) \| `high`
`provider`	Optional. Set to `lakera` for Lakera Guard API

Modes: block, warn

`pii`

PII detection and redaction. Detects emails, phone numbers, SSNs, credit cards, IBANs, IP addresses, and API keys.

agents/agent.yaml

# Input: "My email is john@example.com and SSN is 123-45-6789"
# After redaction: "My email is [EMAIL_REDACTED] and SSN is [SSN_REDACTED]"

guardrails:
  input:
    - type: pii
      mode: redact
      config:
        entities: [email, phone, ssn, credit_card]

Config	Description
`entities`	List of entity types to detect (default: all). Available: `email`, `phone`, `ssn`, `credit_card`, `iban`, `ip_address`, and `api_key`.

Modes: block, warn, redact

`moderation`

Content moderation and safety classification. Works on both input and output.

agents/agent.yaml

guardrails:
  input:
    - type: moderation
      mode: block
      config:
        categories: [hate, harassment, self_harm, violence, sexual]

Config	Description
`categories`	`hate`, `harassment`, `self_harm`, `violence`, `sexual`, `illegal_activity`, `dangerous_instructions`
`threshold`	0.0-1.0 confidence threshold (default: 0.7, external providers only)
`provider`	Optional. `openai` (OpenAI Moderation API) or `perspective` (Google Perspective API)

Modes: block, warn

`topic_restriction`

Keep your agent on-topic using an LLM classifier call.

Adds one LLM call per request. The model field selects the classifier model.

agents/agent.yaml

guardrails:
  input:
    - type: topic_restriction
      mode: block
      config:
        allowed_topics: [product support, billing, account help]
        off_topic_message: "I can only help with product support, billing, and account questions."
        model: connic/gpt-5.6-luna

Config	Description
`allowed_topics`	List of allowed topic descriptions
`blocked_topics`	List of explicitly blocked topics (alternative to allowed_topics)
`off_topic_message`	Custom rejection message
`model`	Model for classification (e.g., `openai/gpt-5-mini`). Supports all providers including custom OpenAI-compatible providers. Defaults to agent model.

Modes: block, warn

`regex`

Custom regex pattern matching for business rules. Works on both input and output.

agents/agent.yaml

guardrails:
  input:
    - type: regex
      mode: block
      config:
        patterns:
          - pattern: "(?i)\\b(drop|delete|truncate)\\s+table\\b"
            message: "SQL commands are not allowed"
  output:
    - type: regex
      mode: warn
      config:
        patterns:
          - pattern: "(?i)internal use only|confidential"
            message: "Output contains internal-only content"

Config	Description
`patterns`	List of `{pattern, message}` objects

Modes: block, warn

Output Guardrails

In addition to moderation and regex (which work on both input and output), these guardrails are specific to output:

`pii_leakage`

Checks agent responses for the configured PII entity types.

agents/agent.yaml

guardrails:
  output:
    - type: pii_leakage
      mode: block
      config:
        entities: [ssn, credit_card, api_key]

Config	Description
`entities`	Entity types to detect (default: `ssn, credit_card, api_key`)

Modes: block, warn, redact

`system_prompt_leakage`

Checks whether an agent response exposes the configured system prompt.

agents/agent.yaml

guardrails:
  output:
    - type: system_prompt_leakage
      mode: block
      config:
        similarity_threshold: 0.6

Config	Description
`similarity_threshold`	0.0-1.0 (default: 0.6). How similar to the system prompt the output must be to trigger.

Modes: block, warn

`relevance`

Checks whether a response is relevant to the user input and agent purpose with an LLM classifier.

Adds one LLM call per request. The model field selects the classifier model.

agents/agent.yaml

guardrails:
  output:
    - type: relevance
      mode: warn
      config:
        context: "Responses must relate to the user's support request."
        model: connic/gpt-5.6-luna

Config	Description
`context`	Additional description of what "relevant" means
`model`	Model for classification. Defaults to agent model.

Modes: block, warn

`data_exfiltration`

Detect data exfiltration attempts in output: suspicious URLs with encoded data and markdown images to external domains.

agents/agent.yaml

guardrails:
  output:
    - type: data_exfiltration
      mode: block
      config:
        allowed_domains: [example.com, cdn.example.com]

Config	Description
`allowed_domains`	List of allowed external domains (default: none, all flagged)

Modes: block, warn

External Providers

Set config.provider on supported guardrails to use one of these services:

Provider	For	Setup
`openai`	`moderation`	Uses the OpenAI provider credentials configured for the Project
`lakera`	`prompt_injection`	Add `LAKERA_API_KEY` as an environment variable. Get your key from platform.lakera.ai
`perspective`	`moderation`	Add `GOOGLE_PERSPECTIVE_API_KEY` as an environment variable. Enable the API in your Google Cloud Console and create an API key

OpenAI Moderation Example

agents/agent.yaml

guardrails:
  input:
    - type: moderation
      mode: block
      config:
        provider: openai
        categories: [hate, self_harm, violence, sexual]
        threshold: 0.7

Lakera Guard Example

agents/agent.yaml

guardrails:
  input:
    - type: prompt_injection
      mode: block
      config:
        provider: lakera

Perspective API Example

agents/agent.yaml

guardrails:
  input:
    - type: moderation
      mode: block
      config:
        provider: perspective
        threshold: 0.7
        languages: [en]     # Configurable language list

Continue with guardrails

Guardrails

Execution order and rule modes

Custom Guardrails

Write application-specific checks in Python

Agent Configuration

Configure guardrails in agent YAML

Observability

Monitor guardrail violations in traces