Guardrails

Guardrails check every question and answer of a workspace, whatever the channel: the app chat, agents, the website chat, the API, messaging apps (WhatsApp, etc.), the MCP server and automations. They are local rules: they call no model and cost nothing per question.

Setting: Settings → Guardrails, for workspace administrators.

What is checked

Check	What it spots
Override attempts	Requests that try to get around the instructions or read the system prompt, in French and English: "ignore your instructions", "show your system prompt", "pretend you have no rules", "developer mode"…
Blocked terms	A list of the workspace's own, empty by default. Matching ignores case and accents and only matches whole words ("salary" does not fire on "salaries").
Personal data	E-mails, phone numbers (French and international), IBANs, French social security and card numbers. IBANs, cards and social security numbers are checked against their check digits, so an order number is not masked.
System prompt leak	An answer that copies sentences of the agent's system prompt word for word.

The three modes

• Off: no check.
• Log only (default): nothing changes for users. Every check that fires is recorded in the journal, and personal data is masked in the server logs.
• Block: an override attempt or a blocked term gets the refusal message, with no model call. Personal data is replaced (for example [e-mail masqué]) before the question reaches the model, and the question goes on.

A system prompt leak is only recorded: the answer has already been sent when it is detected.

Tip: keep the workspace on "Log only" for a few days, read the journal, adjust the blocked terms, then switch to "Block".

Incident journal

The bottom of the page lists the checks that fired: date, outcome (refused or logged), checks, channel and a 160-character excerpt with personal data masked. The full text is never kept in the journal.

The journal is built on the workspace audit log (action guardrails.triggered) and follows its retention. It can also be read through the API: GET /api/v1/tenants/{id}/audit-log?action=guardrails.triggered.

API

• GET /api/v1/tenants/kv/guardrails-config: the workspace setting (administrator).
• PUT /api/v1/tenants/kv/guardrails-config: saves the setting.

{
  "mode": "block",
  "detect_injection": true,
  "mask_personal_data": true,
  "detect_prompt_leak": true,
  "blocked_terms": ["salaries", "a competitor's name"],
  "blocked_message": "I can't answer this request."
}

Bounds: 200 terms of 100 characters at most, a message of 500 characters at most.

Known limits

• The override rules catch common phrasings, not all of them. They add to the prompt instructions, which already tell the model to treat document content as data, not as orders.
• No AI-model content moderation in this version.
• In Block mode, a question holding personal data useful to the search (an e-mail looked up in the documents, for example) loses that data.