Documentation

Guardrails

Functions that inspect text at a stage of the run and return allow, redact, or block. Jailbreak and PII are on by default.

What they are

A guardrail is a function that inspects text at a stage of the run and returns allow, redact, or block.

Stage	When	Typical use
`input`	Before the model sees the user	Jailbreak, size, SSN
`tool`	Before/after a tool call	Block `rm -rf`, redact secrets in tool output
`output`	Before you return to the user	PII, policy language, prompt-leak

Use guardrails on anything public or anything that can mutate money/data. They are cheaper and more reliable than “please don’t” in the system prompt (the prompt still helps; rails enforce).

Built-in security (on by default)

Unless you call .security(false):

Jailbreak / DAN / “ignore previous instructions”
Prompt-injection markers
PII redaction (email, phone, SSN, cards) on input, output, and tools
Secret leak blocking
System-prompt leak blocking
Maximum input length

Tune instead of disabling when you can:

security.ts

.security({
  jailbreak: true,
  promptInjection: true,
  pii: { redact: true, block: false },
  secretLeak: true,
  systemPromptLeak: true,
  maxInputChars: 32_000,
})

Custom rails

no-ssn.ts

import type { Guardrail } from "shirube-ai";

const noSsn: Guardrail = {
  name: "block_ssn",
  stage: "input",
  run: ({ text }) => {
    const hit = /\d{3}-\d{2}-\d{4}/.test(text);
    return {
      action: hit ? "block" : "allow",
      tripwireTriggered: hit,
      reason: "National ID numbers are not accepted in chat.",
    };
  },
};

Agent.builder()
  .inputGuardrails([noSsn])
  .outputGuardrails([])
  .toolGuardrails([]);

stage may be one value or an array (["input", "output"]).

Actions

Result	Effect
`allow`	Continue with original or `text` you return
`redact`	Continue with rewritten `text` (PII → placeholders)
`block` + `tripwireTriggered`	Throw `GuardrailTripwireError` and stop the run

Input tripwires fail the request *before* a model call (saves money). Output tripwires prevent a bad answer from reaching the user.

Every rail that fired is listed on result.guardrails and as guardrail.triggered events.

Handoffs

Structured output