Skip to main content
Connic

Set security rules for AI agents.
Built into Connic.

Untrusted input is evaluated before execution and the final answer before release. Built-in or custom Python policies can block, warn, or redact, with every decision attached to the trace.

Start for freeSee the guardrails walkthrough
Read the guardrails docs
  1. prompt_injectionInput
    passed
  2. piiInput
    redacted
  3. agent executionRuntime
    completed
  4. moderationOutput
    passed
  5. system_prompt_leakageOutput
    passed
john@example.com[EMAIL_REDACTED]

Check inputs and responses for security risks

Use guardrails to check incoming content before the agent processes it and responses before they are released. Every decision is logged, including when processing continues.

Untrusted input
Connector payload or API request
Controlled execution
Block, warn, or redact
An input block skips agent execution and before middleware. After middleware still runs by default, unless run_after_on_block: false is set.

Detect risks with rules and AI

Combine fast standard checks, context-aware AI checks, and custom Python rules to suit your application.

Built-in guardrail coverage
RuleDirectionModesPurpose
prompt_injectionInputblock · warnDetect instruction-hijacking patterns
piiInputblock · warn · redactDetect or replace configured PII entities
moderationBothblock · warnCheck configured safety categories
topic_restrictionInputblock · warnClassify requests against allowed or blocked topics
regexBothblock · warnApply application-specific text patterns
pii_leakageOutputblock · warn · redactKeep configured PII out of responses
system_prompt_leakageOutputblock · warnCompare output with the actual system prompt
relevanceOutputblock · warnClassify whether the answer stayed relevant
data_exfiltrationOutputblock · warnFlag suspicious external URLs and encoded payloads

External provider options are available for prompt injection and moderation checks. Review every built-in guardrail and provider.

Start with four security checks for AI agents

Check for prompt injection, personal data, harmful responses, and system prompt disclosure. Use execution traces to adapt the configuration to your application.

agents/support-agent.yaml
guardrails:
  input:
    - type: prompt_injection
      mode: block
    - type: pii
      mode: redact
  output:
    - type: moderation
      mode: block
    - type: system_prompt_leakage
      mode: block
Guardrail evaluation results
SpanStatus
guardrail:prompt_injectionpassed
guardrail:piiredacted
guardrail:moderationpassed
guardrail:system_prompt_leakagepassed
Every evaluation records rule, direction, status, provider, and detection details.
  • block

    Replace the unsafe response or skip agent execution for an input violation.

  • warn

    Record the violation as a trace span and let processing continue.

  • redact

    Replace detected PII with typed placeholders on supported PII checks.

Application-specific guardrails in Python

Custom checks cover tenant authorization, record shape, internal policy, and other application-owned validation.

guardrails/require-ticket.py
from connic import GuardrailResult
import re

def check(content: str, context: dict) -> GuardrailResult:
    """Require a ticket ID before this agent runs."""
    if not re.search(r"TICKET-\d{4,8}", content):
        return GuardrailResult(
            passed=False,
            message="Include a valid ticket ID."
        )

    return GuardrailResult(passed=True)

  • Required export

    A matching file under guardrails/ exports check(content, context).

  • Sync or async

    A policy or authorization service can handle cases where a local rule is not enough.

  • Fail through the configured mode

    An exception is logged and handled as a violation: warn continues; block stops processing.

  • Logs stay attached

    Print, stderr, and standard logging appear under guardrail.<name> on the same run.

Input checks run before middleware

An input guardrail cannot depend on context values that before middleware has not created yet. The request is available from content; authorization checks that require middleware-enriched context belong in middleware or an output guardrail.

Keep exploring

Approvals

Put a human before sensitive tool calls.

Observability

Inspect every evaluation in its run trace.

AI Governance

Turn runtime evidence into a governed record.

Testing

Exercise safety behavior before release.

Tools

Keep business actions narrow and explicit.

Managed Runtime

Enforce runtime limits around every run.

Frequently Asked Questions

Input guardrails run before middleware and agent execution. Output guardrails run after agent execution and after middleware. If an input rule blocks, the agent and before middleware are skipped; after middleware still runs by default unless run_after_on_block is false.

Block stops processing and returns the configured rejection response; an output block replaces the unsafe answer. Warn records a violation in the trace and continues. Redact replaces detected content with typed placeholders and is available for the PII input and PII-leakage output checks.

Built-in rules cover prompt injection, PII, moderation, topic restriction, regex patterns, output PII leakage, system-prompt leakage, relevance, and data exfiltration. Moderation and regex can run on both input and output.

Yes. A Python file under guardrails/ matches the rule configuration by name and exports a synchronous or asynchronous check(content, context) function that returns GuardrailResult.

The runtime captures and logs the traceback under guardrail.<name>, then treats the exception as a violation. Warn mode continues processing, while the default block mode stops processing and returns the configured rejection message.

Yes. Every evaluation becomes a span in the run trace with the rule name, input or output direction, provider, status, and detection details. Custom guardrail logs are attached to the same run.