Guardrails
Guardrails are checks every run passes through. They are set once per workspace and apply to every agent in it. A guardrail names what it looks at (target:input, output, or both), how it looks (kind), and what
happens when it trips (action).
Input guardrails run on the user’s message before the agent sees it. Output
guardrails run on the agent’s final reply before it is returned. An answer to
a question the agent asked (a paused run being resumed) is not screened.
Kinds
Actions
- block stops the run. The run ends with the error
Blocked by guardrail "<name>" (input|output). A blocked reply is not stored as the run’s output. - redact rewrites the text and continues. On input, the agent only ever sees the masked message. On output, the user gets the masked reply.
- warn records the trip and changes nothing.
guardrail step
with what matched (or which questions crossed their threshold), and streams to
clients as a GuardrailTriggered event.
When an output guardrail can block or redact, the reply is not streamed token
by token. It is checked first and sent whole. Warn-only output guardrails do
not affect streaming.
Semantic guardrails
A semantic guardrail is a list of statements about the text. Each is sent to a decision model (TypeSafe’s Jev, through your workspace’s TypeSafe or OpenRouter connection), which returns the probability that the statement is true. At or above the threshold (default 0.7) the statement counts as yes and the guardrail trips. All statements from all semantic guardrails on a side go out as one call, so adding a question costs tokens, not latency. A call takes well under a second and a fraction of a cent, and its cost is metered on the run. Write statements that are true when you want the guardrail to trip, and keep each one to a single judgement:config is { "questions": { "<id>": { "instructions": "...", "threshold": 0.8 } }, "threshold": 0.7, "context": "...", "failClosed": false }.
A question may also be a bare string.
If the decision model cannot be reached, a semantic guardrail passes and records
the error, so an outage does not stop every run. Set failClosed on a guardrail
where an unchecked message is the worse outcome; it then blocks instead.
Semantic guardrails need a connection in Model Gateway: a typesafe one
(TypeSafe’s own API, used first when present) or an openrouter one (Jev is
served there on a decisions endpoint). Redact is not available for them: there
is no span to mask.
Other kinds
Prompts
A versioned registry of prompt templates. Templates use{{variable}}
placeholders; every edit bumps the version so callers can pin a revision.