Guardrails

Guardrails inspect incoming requests and outgoing responses with target-based rules: deterministic checks, enforcement, or content injection. They also work on streaming paths and rules can be workspace-scoped.

#Modes

check

Evaluates and logs the rule without altering the request (observe).

enforce

Blocks the request/response on a rule violation.

inject

Injects content into the request/response (e.g. a system directive or notice).

#Targets

A rule can target the incoming request (prompt) or the outgoing response. 12 deterministic check types run chunk-by-chunk (buffered) on streaming responses.