Skip to content
Nappai Documentation

Guardrails

Guardrails gives an agent rules it never breaks. You write them in your own words (“never cancel orders: cancellations are done by phone”, “don’t recommend other shops”, “don’t give legal advice”) and they are checked at two moments:

  • Every request: if someone asks for something a rule forbids, or tries to make the agent forget its instructions, the agent does nothing and answers with a short, polite sentence in the writer’s language.
  • Every action: before the agent uses one of its tools, what it is about to do is checked. Even if nobody asked for it, an action that breaks a rule is not run, and the agent explains it to the customer.

The agent’s instructions tell it how to work; the Guardrails rules override them. If old instructions tell it to cancel orders and a rule forbids it, the order is not cancelled.

It is available in Agent, Simple Agent, Deep Agent and the voice agents, Voice Agent and Voice Agent Realtime (see On voice agents below). In Deep Agent, the built-in helper the agent hands tasks to follows the same rules; agents you connect as helpers follow their own.

See it in action

This narrated video shows a coffee shop agent that looks up and cancels orders. First it cancels an order on its own; then we turn on Guardrails with two rules and try a forbidden request, an action the agent decides on its own, and a normal question. At the end, the same setting on a voice agent.

When to use it

  • Your agent can do things with its tools that only a person should do: cancel, refund, delete, send.
  • Your agent serves customers and must stay away from some topics: competitors, prices that are not public, legal or medical advice.
  • You want nobody to make the agent ignore its instructions by writing “forget what you were told”.
  • A company policy must always be followed, even when the agent’s instructions or model change.

Configuration

Open the agent’s settings and, in the Advanced tab, turn on Guardrails. On an agent created before this option existed, the switch only appears once you add the component to the canvas again. These fields appear, and the Guardrail Model connection appears on the component:

FieldWhat it does
GuardrailsTurns the checks on. Off by default: the flows you already have do not change.
Guardrail RulesThe rules, in plain words, one per line. Giving the reason helps: “Never cancel orders: cancellations are only done by phone, on 900 123 456.” With no rules, nothing is checked.
Refusal MessageA fixed reply for a refused request. Leave it empty and the agent answers with a short sentence in the writer’s language.
If The Check FailsWhat happens when the check cannot run (the checking model does not answer or takes too long). Let the request through (default): the request goes ahead and it is recorded. Refuse the request: it is refused, for rules that may never be skipped.
Guardrail ModelConnection for the model that does the checking. Without one, the agent’s own model checks. A small, fast model makes the check barely noticeable.

What you will notice

  • A request that breaks no rule is answered as before: its check runs while the agent starts working.
  • Before each tool, the agent waits for that action to be checked. With a fast model connected to Guardrail Model this is barely noticeable.
  • If the agent shows its answer as it writes it, the text of a refused request is never shown: only the refusal appears.
  • Every refused request, stopped action and failed check is recorded in the run details, with the rule that applied.

On voice agents

In Voice Agent and Voice Agent Realtime, Guardrails is in the Advanced tab, in the Guardrails group, with the same fields except Refusal Message. During a call every action is checked before it happens: if it breaks a rule, the tool is not used and the agent explains it to the caller in its own words.

What the caller says is not checked before the agent answers: on a call that would make every answer wait. What the rules protect is what the agent does.

  • Guardrail Model: connect a small, fast model, with its reasoning at the minimum in its own component. The check then takes a fraction of a second, and only when the agent uses a tool; the rest of the conversation is just as fast. In Voice Agent, without one the agent’s own model checks (slower). In Voice Agent Realtime it is required, because the realtime model cannot do the check.
  • If the checking model fails, it is recorded in Executions (and, when you try the call from the canvas, its component turns red), without cutting the call. If The Check Fails decides whether the action goes ahead or is refused.
  • With Guardrails off or no rules written, the voice agent checks nothing and takes no extra time.

Good practices

  • Write specific rules and say why they exist; the reason helps in borderline cases.
  • Put what must never happen in Guardrail Rules, and how you want the agent to work in its instructions. Don’t say the same thing in both places with different words.
  • Before deploying, try in the Playground a forbidden request, an allowed one, and a situation where the agent might act on its own.
  • Use Refuse the request in If The Check Fails only when you would rather not serve a customer than skip a rule.