Skip to main content
Connic

Inspect every boundary.
Evaluate output before release.

Evaluate untrusted input before execution and the final answer before release. Block, warn, redact, or run your own Python policy, with every decision attached to the trace.

Start with BasicSee the guardrails walkthrough
Read the guardrails docs
  1. prompt_injectionInput
    passed
  2. piiInput
    redacted
  3. agent executionRuntime
    completed
  4. moderationOutput
    passed
  5. system_prompt_leakageOutput
    passed
john@example.com[EMAIL_REDACTED]
Independent enforcement

Enforce content policy at runtime boundaries

Instructions shape normal model behavior. Guardrails evaluate the content at the runtime boundary, before the agent sees an input and after it produces an output. The decision is recorded even when the request continues.

Untrusted input
Connector payload or API request
Controlled execution
Block, warn, or redact
An input block skips agent execution and before middleware. After middleware still runs by default, unless run_after_on_block: false is set.
Built-in checks

Cover the input and the answer

Use lightweight checks for common risks, model-backed classifiers when context matters, and custom Python when the policy belongs to your application.

Built-in guardrail coverage
RuleDirectionModesPurpose
prompt_injectionInputblock · warnDetect instruction-hijacking patterns
piiInputblock · warn · redactDetect or replace configured PII entities
moderationBothblock · warnCheck configured safety categories
topic_restrictionInputblock · warnClassify requests against allowed or blocked topics
regexBothblock · warnApply application-specific text patterns
pii_leakageOutputblock · warn · redactKeep configured PII out of responses
system_prompt_leakageOutputblock · warnCompare output with the actual system prompt
relevanceOutputblock · warnClassify whether the answer stayed relevant
data_exfiltrationOutputblock · warnFlag suspicious external URLs and encoded payloads

External provider options are available for prompt injection and moderation checks. Review every built-in guardrail and provider.

Secure baseline

Start with four explicit checks

Start with prompt injection and PII on input, then moderation and system-prompt leakage on output. Tune from observed traces instead of guessing.

agents/support-agent.yaml
guardrails:
  input:
    - type: prompt_injection
      mode: block
    - type: pii
      mode: redact
  output:
    - type: moderation
      mode: block
    - type: system_prompt_leakage
      mode: block
Guardrail evaluation results
SpanStatus
guardrail:prompt_injectionpassed
guardrail:piiredacted
guardrail:moderationpassed
guardrail:system_prompt_leakagepassed
Every evaluation records rule, direction, status, provider, and detection details.
  • block

    Replace the unsafe response or skip agent execution for an input violation.

  • warn

    Record the violation as a trace span and let processing continue.

  • redact

    Replace detected PII with typed placeholders on supported PII checks.

Application policy

Write application-specific guardrails in Python

Use custom checks for tenant authorization, record shape, internal policy, and other application-owned validation.

guardrails/require-ticket.py
from connic import GuardrailResult
import re

def check(content: str, context: dict) -> GuardrailResult:
    """Require a ticket ID before this agent runs."""
    if not re.search(r"TICKET-\d{4,8}", content):
        return GuardrailResult(
            passed=False,
            message="Include a valid ticket ID."
        )

    return GuardrailResult(passed=True)

  • Required export

    Export check(content, context) from a matching file under guardrails/.

  • Sync or async

    Call your own policy or authorization service when a local rule is not enough.

  • Fail through the configured mode

    An exception is logged and handled as a violation: warn continues; block stops processing.

  • Logs stay attached

    Print, stderr, and standard logging appear under guardrail.<name> on the same run.

Input checks run before middleware

An input guardrail cannot depend on context values that before middleware has not created yet. Read the request from content, move that authorization check into middleware, or perform it in an output guardrail when middleware-enriched context is required.

Keep exploring

Approvals

Put a human before sensitive tool calls.

Observability

Inspect every evaluation in its run trace.

AI Governance

Turn runtime evidence into a governed record.

Testing

Exercise safety behavior before release.

Tools

Keep business actions narrow and explicit.

Managed Runtime

Enforce runtime limits around every run.

Frequently Asked Questions

Input guardrails run before middleware and agent execution. Output guardrails run after agent execution and after middleware. If an input rule blocks, the agent and before middleware are skipped; after middleware still runs by default unless run_after_on_block is false.

Block stops processing and returns the configured rejection response; an output block replaces the unsafe answer. Warn records a violation in the trace and continues. Redact replaces detected content with typed placeholders and is available for the PII input and PII-leakage output checks.

Built-in rules cover prompt injection, PII, moderation, topic restriction, regex patterns, output PII leakage, system-prompt leakage, relevance, and data exfiltration. Moderation and regex can run on both input and output.

Yes. Add a Python file under guardrails/ whose name matches the rule configuration and export a synchronous or asynchronous check(content, context) function that returns GuardrailResult.

The runtime captures and logs the traceback under guardrail.<name>, then treats the exception as a violation. Warn mode continues processing, while the default block mode stops processing and returns the configured rejection message.

Yes. Every evaluation becomes a span in the run trace with the rule name, input or output direction, provider, status, and detection details. Custom guardrail logs are attached to the same run.