Guardrail rule types

Every rule falls into one of these 8 types:

Rule type	What it checks	You configure
Content Safety	Harmful, offensive, or toxic language	A sensitivity threshold from 0 to 1
PII Protection	Personal identifiable information	Which entity types to catch — email, phone, ssn, credit_card, address, dob, passport, ip_address
Jailbreak Detection	Attempts to bypass an assistant’s instructions or safety rules	A detection sensitivity — low, medium, or high
Allowed Topics	Keeps conversations inside specific subject areas	The list of allowed topics
Restricted Topics	Blocks conversations that touch specific subjects	The list of restricted topics
Language Enforcement	Requires replies to be in one of your chosen languages	The list of allowed languages
Keyword Filter	Blocks messages containing specific words or phrases	The list of strings to block
Competitor Mentions	Detects mentions of competitor products or brands	The list of competitor names

Reading a rule

Each rule in a pack shows its name, a severity badge (low, medium, or high), and its category. Expand one to see its description and settings, and use the toggle beside it to turn that single rule on or off without removing it. Edit opens its settings; + Add Rule adds another.

What happens when a rule triggers

A rule’s effect is fixed by its type, and stated in its own description — there’s no separate action setting to choose:

• PII Protection rules redact what they find, leaving the rest of the message intact.
• Content Safety, Jailbreak Detection, and the other types block.

There’s no “log only” option — a rule either redacts or blocks; it never just quietly records a violation.

Rules apply to both sides of a conversation. A pack typically pairs an input rule with a matching output rule — pii_input and pii_output, for instance — so the same standard applies to what’s sent and what comes back.

When something is blocked, you’ll see it directly in the conversation, with a link to view the audit trail behind that decision.