An agent that can take actions needs defense in depth. We run guardrails at five distinct stages, each catching a different class of failure.
The five stages
- Input — prompt-injection and jailbreak detection
- Retrieval — poisoned-document and indirect-injection screening
- Tool-call — authorization and parameter validation
- Output — PII redaction, secret scanning, grounding checks
- Post-action — audit and anomaly detection
An agent that invents an answer is worse than one that admits it doesn't know.
When confidence drops below the floor, the agent returns a graceful, structured refusal instead of a plausible hallucination. Saying 'I don't know, let me get a human' is a feature, not a failure.