MCintelligentplus DocsGuardrails
Screen prompts, tool calls and model output with pluggable providers
Guardrails
Guardrails screen untrusted text — user prompts, tool arguments and results, and model output — at the moments they would otherwise reach the agent or the user. Every guardrail is a row: a provider, the hooks it serves, a log/enforce policy, and provider-specific configuration. Admins manage them at Admin → Guardrails.
The framework is log-first: a provider records findings without acting on them until the row is switched to Enforce. That makes it safe to bring up a new detector against real traffic, compare providers in the Test Playground, and only then let it block.
Providers run in-process (AGT, ATR — a few milliseconds) or call sidecar services over HTTP (Presidio, PIGuard):
AGT (prompt injection)
The platform's built-in prompt-injection detector — always available, no services to run
Agent Threat Rules (ATR)
825 MIT-licensed regex rules in 10 categories, mounted as a corpus — great for broad, explainable coverage
Presidio (PII)
Microsoft Presidio detects and masks emails, SSNs, credit cards and more, inbound or in model output
PIGuard (ML classifier)
A DeBERTa-based prompt-injection classifier, strongest on indirect injection hiding in tool results
Where guardrails run
| Hook | Runs on |
|---|---|
pre_call | Inbound chat text, before the agent starts — prompt-injection and PII screening of user input |
post_call | Assistant output before it is finalised — output PII masking |
pre_mcp_call | MCP tool arguments before the tool executes. Block-only: a guardrail may withhold the call but never rewrites its arguments |
post_mcp_call | MCP tool results before the model reads them — indirect prompt injection and leaked PII |
logging_only | Wildcard mode: the row observes every hook without ever acting |
Text roles are filtered per row: system messages are skipped by default, and
Presidio additionally scans only the roles in its scope (e.g. user, tool).
Row settings
| Setting | Effect |
|---|---|
| Default On | Off removes the row from selection entirely (an admin decision — it also disables the built-in AGT baseline). |
| Enforce | Off (default) records findings as would_block / would_mask in the events log and leaves traffic untouched; On acts on the provider's verdict — block, withhold, or mask. |
| Skip system / tool messages | Per-row payload filters. |
timeout_ms | Per-call evaluation budget (50–30000 ms). A timeout is a provider error. |
on_error | What a provider error means: fail_open (default — proceed and record failed_open) or fail_closed (block when enforcing). |
Rollout: log first, then enforce
- Create the row with Enforce = Off — findings start landing in the events log with no effect on traffic.
- Compare candidates in the Test Playground (below) and review real findings under Events & dashboard; tune thresholds and categories until benign traffic is clean.
- Flip Enforce = On in the table. To roll back, flip it back — rows are read live on every hook, no restart or redeploy.
Test Playground
The Test Playground tab dry-runs any selection of guardrails against one sample text, without writing events or blocking anything:
- Pick the hook and the payload role — the list shows exactly the rows that would serve that hook.
- Tick the comparisons you want (e.g. AGT vs PIGuard on an injection, Presidio on PII), paste the text, and run.
- Each result card shows the provider's raw verdict next to the row's projected policy — "would block" for an enforcing row, or "logs only — would block if enforced" — plus score/threshold, reason, masked output and latency.
Events & dashboard
Every non-pass finding writes an event (redacted excerpt only — never raw input
text): outcome, action taken, score, latency, hook and surface. The dashboard
rolls the same table up over a 24-hour window — totals by outcome/provider/hook,
a blocks-over-time series, and latency p50/p95. Non-AGT enforce-blocks also
appear in Audit Logs (action=guardrail.blocked).
Admin → System → Security still matters. Its prompt-guard mode
(off / audit / enforce) remains the master knob for the baseline detector:
in audit mode the AGT guardrail records findings but cannot block, and the
guard still protects paths the guardrails framework does not cover yet (skill,
org-agent and workspace-instruction writes, user prompts, and MCP tool
descriptions). Keep the security page as-is and configure new screening here.