Guardrails

A guardrail is a check that runs on the model and tool calls an agent makes. Guardrails can hide personal data before the model sees it, pause the thread so a person approves an action, stop an unexpectedly large request, or check the final answer against the agent's sources. You attach them per agent, so each agent gets the controls its work calls for.

Open the Guardrails page

Guardrails are part of Agent Studio. Open the Settings tab and choose Guardrails in the Agent Studio group, or click the Guardrails card on the Ecosystem page. The page, Checks that run on every model and tool call an agent makes., lists every guardrail as a card, grouped into three families:

• PII detection: finds personal data and secrets with patterns and checksums, then hides or blocks them before the model sees them.
• Human in the loop: pauses the thread before chosen tools run, so a person can approve, edit, reject or answer instead.
• Custom: SPARK's own checks on the same hooks, either rule-based or checked by a model.

Each card carries a chip for how it decides:

• Deterministic: rules such as patterns, checksums and counts. The same input always gives the same result, with no model call.
• Model-based: a model checks it. It catches what rules miss, at the cost of an extra model call.

Guardrails that ship with SPARK carry a Built-in badge. Use the search (Search guardrails) to filter, and Collapse all to fold every family.

The built-in guardrails

Built-in guardrails cannot be changed. Open one to read its settings in Built-in guardrail (It can't be changed. Duplicate it to make a copy you can edit.), then Duplicate it to make a copy you can edit.

Create your own guardrail

Click New, or Duplicate a card from its ⋯ menu. In the New guardrail dialog (A check that runs on every model and tool call of the agents it is attached to.), give it a Name and a one-line Description, choose its Kind, then fill in the settings for that kind:

PII detection (Deterministic, runs before every model call)

• What to hide: any of Email addresses, Card numbers, IP addresses, MAC addresses, Web addresses, IBANs, Phone numbers and API keys and secrets.
• Your own terms: one per line, such as a client or project name, up to 50 terms. Under Your own patterns, Add pattern adds a name and a regular expression, up to 20 patterns; the name is what the model sees instead.
• How to hide: Remove it (each match becomes a label such as [REDACTED_EMAIL]), Mask all but the last characters, Replace with a stable code (the same value always gets the same code, so the model can still tell values apart) or Refuse the message.
• Where: Your messages and attachments, Tool results and Agent answers.
• Try it: type a message and click Try to see what the model would get with these settings.

Human in the loop (Deterministic, runs before a chosen tool)

• Tools that need approval: turn on Every connector tool that writes, or choose Specific tools.

Context budget (Deterministic, runs before every model call)

• Ask before sending more than a number of tokens, from 1,000 to 2,000,000. The dialog translates it into roughly how many pages of text it is.

Grounded answers (Model-based, runs on the final answer)

• Revise the answer, then flag it: the agent rewrites its answer once using only its sources, and flags anything still unsupported.
• Flag it only: the answer stays as written, and the unsupported statements are flagged.

Click Create. Your own guardrails show in the matching family, and their card menu offers Edit guardrail, Duplicate and Delete.

Attach guardrails to an agent

1. Open the agent in Agent Studio › Agents.
2. In the Guardrails section, click + (Add guardrails), or Add while it is empty.
3. In Select guardrails (Choose the checks that run on this agent's model and tool calls.), tick each guardrail you want in the list, grouped by family, or click a guardrail to read it and use Add. The detail shows its source, such as Built-in, its Family, Method and when it Runs.
4. Click Apply, then save the agent.

Approve, edit or reject in a thread

When a human-in-the-loop guardrail stops a tool call, the agent's message shows an approval card, headed by the guardrail's name: The agent wants to run this tool. Choose what happens. (or, for several tools, what happens to each). Each tool is listed with the arguments the agent wants to send. For each tool, choose:

• Approve: the tool runs as the agent asked.
• Edit: change the tool's Arguments (JSON), then let it run.
• Reject: the tool does not run. Add an optional Note for the agent explaining why.
• Respond: the tool does not run, and the agent gets Your answer instead.

Then click Submit. The agent continues with your decision.

In a channel's thread, only the person the agent is answering decides. Everyone else sees Waiting for that person to decide, with Stop, which ends the turn for everyone.

A Context budget card says how large the request is against the agent's limit and lists its Largest parts, so you can decide whether to send it.

Pauses SPARK adds by itself

Some pauses are not guardrails you attach: SPARK adds them to a thread when the agent's tools call for them.

• Questions to you: when the agent asks you to choose how it goes on, the thread waits for your answer.
• How to read a document: before an agent reads a whole document, you choose how it reads it.
• Skills the agent wasn't given: before an agent reads a skill outside its own, you choose whether it may.

These never appear on the Guardrails page or in the picker.

Guardrails in the steps

A guardrail that acts on a turn shows in the answer's steps, so you can see what it hid, flagged or paused.

Where to go next

• Create an agent
• Start a thread
• Human in the loop in workflows
• Tools