Guardrails in Agent Studio

Guardrails in Agent Studio protect your confidential information by blocking unauthorized data transmission to Large Language Models (LLMs) during workflow runs.

Define these security controls at the workflow level to intercept prompt inputs, tool calls, and model outputs. You can configure them to either block non-compliant requests or mask sensitive tokens before data reaches the model. Functioning as an intermediary layer between your workflow and the LLM, these controls intercept communications at various intervals during an agentic execution. By implementing guardrails, you can identify and obstruct prompt injection attempts, filter sensitive keywords, anonymize Personally Identifiable Information (PII), enforce topic policies, and run custom Python logic, all while maintaining the existing code for agents and tools.

These security measures are applicable to several critical stages, including prompt inputs, LLM-generated outputs, and data retrieved from tools or Model Context Protocol (MCP) servers, ensuring comprehensive data protection.

Because guardrails are defined at the workflow level, they are consistently enforced across every execution, whether the workflow is undergoing internal testing or is active in a production environment.

Guardrail pipeline mechanics

In any workflow, every LLM interaction proceeds through a structured pipeline. Guardrails function by being integrated into this pipeline at specific API calls:

Table 1. Guardrail pipeline mechanics
API calls	Execution Timing
Input (`pre_call`)	Triggered before the message is transmitted to the model.
Output (`post_call`)	Triggered after the model produces a response but before it is delivered.
Tool Call	Triggered once the model initiates a tool request, preceding the tool run.
Tool Result	Triggered after a tool provides data, prior to the model processing that information.
Both	Applies simultaneously to Input and Output, usually used for custom guardrails and content filters.

Depending on your specific configuration, a triggered guardrail responds by either blocking the request, which sends an error message back to the caller, or by masking the sensitive data by substituting it with a placeholder token.