Guardrails

How Prompt Guard, Expert Witnesses, Judge, and Jury layer content safety and PII protection around a call, and why they fail closed by default.

A single content filter is a single point of failure: if it misses a jailbreak attempt or its classifier goes offline, nothing else stands between the request and the model. Agent Stream runs every LLM call through a layered, auditable safety pipeline instead, combining deterministic rules, purpose-trained classifiers, and LLM-based review. No single guardrail outage silently removes protection, so a request stays governed even when one layer fails. PII protection →

What each guardrail layer does

The Prompt Guard fullscreen panel, showing a Regular Expression entry with its When detected action alongside an AI Matching entry with a provider, model, and entity types to detect
LayerRunsWhat it does
Prompt GuardRequest (pattern and AI matching) and response (pattern matching only)Deterministic regex and model-backed PII inspection. Configure each match to reject or redact it with a static placeholder. A stable NER ID pseudonym can preserve relationships between values instead. See PII protection and NER IDs →.
Expert WitnessesRequest seam, response seam, or bothPurpose-trained external safety classifiers, consulted in addition to Prompt Guard. Multiple witnesses can run on one surface.
JudgeRequest, in parallel with the DeciderAn LLM-based, or OpenAI-moderation-based, pre-check that can moderate or block a request before the main model is called. Running in parallel with the Decider absorbs its latency.
JuryResponseA multi-juror LLM post-review that can approve, block, or re-drive (regenerate) the model’s response before it returns, with a single retry policy shared by the whole panel.

Guardrails compose. A surface can run Prompt Guard alone for a low-risk internal tool, or all four layers, plus multiple expert witnesses on both seams, for a customer-facing deployment.

Request-side and response-side guardrails are not the same set of checks:

Request seamPrompt Guard (pattern + AI matching), Expert Witnesses, Judge. Runs before the provider is called, so a block here never incurs a model cost.
Response seamJury, Prompt Guard (pattern matching only), Expert Witnesses. Runs after the model responds, so it catches problems only visible in the output itself.

Built-in Expert Witness providers

Built-in Expert Witness providers include EnkryptAI (Detect API, named-Guardrail, AI-Proxy, and legacy Policy modes), Lakera Guard, Azure Prompt Shields for request-side injection detection, Azure Content Safety for response-side harm moderation, and a generic OpenAI-moderation shape. A new provider onboards through a data-driven profile, declaring its auth header, request template, and verdict rule, rather than through a code change.

Why guardrails fail closed by default

Fail-closed is the default posture of every guardrail: if the guardrail cannot reach its classifier, or its rule engine cannot complete, the request is blocked rather than passed through silently. Fail-open can be set explicitly on a guardrail when the operator prefers availability over protection - a deliberate, per-guardrail choice.

Redact-and-continue

Redact-and-continue is the Prompt Guard behaviour where a matched pattern is replaced in-place, either with a static placeholder such as <EMAIL> or a stable NER ID pseudonym, and the modified request continues down the pipeline. This is distinct from block, which halts the request.

Why layering matters

  • Prompt Guard catches known patterns deterministically and cheaply.
  • Expert Witnesses add purpose-trained detection for categories a regex cannot express, such as jailbreak attempts or nuanced toxicity.
  • Judge stops a clearly unsafe request before the cost of a model call is incurred.
  • Jury catches problems that only appear in the model’s own output, including cases where Judge passed the request but the response itself needs redirection or regeneration.

Rejection category

A Rejection Category is one of the stable canonical labels applied to every guardrail block: hate, toxicity, prompt injection, jailbreak, PII, secrets, policy violation, and more. Categories are what make rejection breakdown dashboards possible per team, member, surface, and stage in Observability →.

A failed source authentication, a rate limit, a required payment, an open circuit breaker, a timeout, or an upstream error stop a request for a different reason: they’re not guardrail content decisions, so they’re recorded by their own pipeline stage rather than as a Rejection Category. See Pipeline and stages → for where each of those stages sits.

  • PII protection and NER IDs: A deeper look at how Prompt Guard detects and pseudonymizes sensitive data.
  • Pipeline and stages: Where guardrail stages sit relative to routing, the provider call, and metering.
  • OPA policies: Access-control decisions that run alongside content guardrails.
  • Governance records: How each guardrail’s verdict and evidence is captured into a signed, tamper-evident transcript.
  • Observability: The rejection breakdown dashboards built from Rejection Category data.