Guardrails overview
Agent Guardrails checks the text going into an agent and coming back out - personal data, credentials, prompt injection, abusive language, and a judgement of what a request is asking for. Off by default, opt-in per agent, three presets, and a monitor mode you should use first.
Quickstart
Turn guardrails on for one agent, send a message containing an email address, watch it get masked and the reply restored, then trigger a refusal - nine commands, end to end.
Policies
The guardrail policy document field by field - presets, modes, actions, thresholds, time budgets, fail-open and fail-closed, the four resolution layers, the tighten-only rule and locked fields, versioning, and a worked custom policy.
Personal data masking
Entity types, the placeholder format, ordinals that stay stable for a whole session, restore versus keep, the mapping reference and its lifecycle, the per-session cap, and exactly what never sees the real value.
Prompt injection and jailbreaks
Direct injection in a user message versus indirect injection carried by a tool result or a fetched document, what each tier catches, how to tune the thresholds, how to read a flag, and a worked indirect-injection example.
Refusal messages
What an end user reads when a request is refused - the platform default sentence, changing it per agent, overriding it in agent code with a string or a callable, the precedence order, and the include-reason and include-verdict-id options.
Guardrails with ADK
Guardrails need no ADK code at all - here is what the zero-code layer already covers, when to add the native integration, where it hooks, per-tool overrides, and the complete in-code crusoe.guard API.
Guardrails with LangGraph
Guardrails need no graph code at all - what the zero-code layer covers, when a hand-built StateGraph needs guarded_tool and guarded_model, the GuardMiddleware for create_agent, per-tool overrides, and the in-code crusoe.guard API.
Guardrails with CrewAI
Guardrails need no crew code at all - what the zero-code layer covers, the CrewAI-native hooks and where they attach, judging one task's output with a task guardrail, per-tool overrides, and the in-code crusoe.guard API.
The standalone API
Run the platform's guardrail checks over text of your own, from anywhere and with no agent involved - which credential to send, every route with curl and Python, request and response bodies, mapping references across two calls, size and rate limits, the eight error codes, and what fail-open and fail-closed mean to a caller.
Verdicts and audit
Reading the verdict feed in the CLI, the API and the Console; what a verdict contains and deliberately does not; the three audit actions guardrails write; retention; and turning a verdict id quoted by a user into the full record.
Limits and latency
The per-tier time budgets, the text size cap, the per-session entity cap, retention bounds, rate limits, and exactly what happens when one tier is unavailable.