Guardrails

Govern › Guardrails holds one policy per tenant. The policy decides which checks run on the prompts that reach a model and on the answers that come back, and what Olympusx AI does with what they find. Admins and builders write it; auditors read it.

For the ideas behind it, see Guardrails.

Who can open it

Role	What they can do
Admin	Read and change the policy.
Builder	Read and change the policy.
Auditor	Read the policy. Every control is disabled, and a Read-only notice says that only an admin or a builder of the tenant can change it.
End user, Reviewer	Cannot open the page.
Platform admin	Read and change the policy of any tenant, and configure the platform’s content scanner.

What the checks detect

Each check reports findings by category. Olympusx AI treats two categories as redactable and three as block-worthy.

Check (console label)	What it finds	Kind
PII detection	Personal data. The bundled scanner looks for person names, email addresses, phone numbers, payment card numbers, IBANs and IP addresses. National identifiers (identity numbers, bank account formats, company tax numbers) come in optional jurisdiction packs that a platform administrator registers.	Redactable
Secret / credential detection	API keys, access tokens, passwords and similar credentials pasted into text.	Redactable
Prompt-injection detection	Text written to override the model’s instructions or escape the application’s rules.	Block-worthy
Toxicity detection	Abusive, hateful or otherwise unsafe language.	Block-worthy
Banned topics	Subjects you name, such as politics or legal advice.	Block-worthy

A finding records the category, the kind of entity (for example EMAIL_ADDRESS), a score and a count. It never records the text that matched.

What Olympusx AI does with a finding

The Enforcement mode decides whether anything is changed.

• Observe — every finding is recorded on the audit trail, and the prompt or answer passes unchanged. Nothing is blocked or rewritten. This is the default for a new tenant.
• Enforce — the two action settings apply:

Finding	Setting	Result
Prompt injection, toxicity or a banned topic	On unsafe content (enforce) = Block	The turn is refused.
Prompt injection, toxicity or a banned topic	On unsafe content (enforce) = Flag only	Recorded; the turn passes.
Personal data or a secret	On PII (enforce) = Block	The turn is refused.
Personal data or a secret	On PII (enforce) = Redact	Each match is replaced by a placeholder naming its kind, such as <EMAIL_ADDRESS>, and the rewritten text goes on.

A block-worthy finding is evaluated first: a prompt with both a banned topic and an email address, under Block for unsafe content, is refused rather than redacted. On PII (enforce) governs secrets as well as personal data.

What a blocked caller sees

• In the console (Playground, assistants, knowledge answers), the turn is replaced by one of two messages: “This message was blocked by your organization’s content-safety policy.” for unsafe content, or “This message was blocked because it contains sensitive data that policy does not allow.” for personal data or a secret.
• An application calling the gateway with an API key receives HTTP 403 with the error code guardrails_blocked and the message “This request was blocked by your organization’s content-safety policy.” See Errors.

Where the policy applies

The policy applies to every model call made in the tenant: the console’s Playground, assistants, agents and knowledge answers, and every application that calls the gateway with an API key.

Apply to chooses the direction:

• User prompts (input) — the prompt is checked before it reaches the model. Enforcement applies in full.
• Model answers — the answer is checked after the model writes it.
  • On the gateway, when this box is checked, Olympusx AI holds each answer until it is complete, checks it, and in Enforce mode redacts or blocks it before the caller receives it. A request made with stream: true then receives its answer in one piece instead of token by token. Leave the box clear if streaming matters more to your applications than checking answers.
  • In the console’s own chat surfaces, answers stream to the reader as they are written, and a finding in an answer is recorded on the audit trail.

Developer keys

Traffic from a developer’s Code Assistant key runs under a code profile, because redacting “personal data” in source code breaks the code. Under the code profile:

• Enforcement mode and both action settings stay as the tenant set them.
• Prompts are checked for secrets and prompt injection, whatever the policy says.
• Answers stream to the developer as they are written.

Audit entries written under this profile say so. See Developer keys.

When no scanner is installed

The checks are performed by the platform’s guardrails service, which a platform administrator installs or points at a scanner your organization already runs. Until one is in place, the page shows Guardrails service not configured: the policy is saved, nothing in it is enforced, and every prompt and answer passes unexamined. The settings take effect as soon as a scanner is configured.

A platform administrator sees Configure a scanner under that notice. It opens the Content scanner wizard, which tests a scanner address and shows the configuration to declare in the cluster. See Configuration.

When the scanner fails

If a scan errors or times out, the platform’s guardrails failure setting decides the outcome for every tenant. Fail closed, the default, refuses the turn: API callers receive HTTP 503 with guardrails_unavailable. Fail open lets the turn through unscanned. A platform administrator sets this in Settings. Content the scanner cannot read at all is refused with HTTP 422 and guardrails_unscannable.

Review capture

Review capture keeps a sample of gateway requests so a reviewer can read them in the Review queue. It is off for every tenant until someone turns it on.

• Keep 1 request in every takes a whole number: 0 keeps nothing, 1 keeps every request, 100 keeps one in a hundred.
• What is kept is the text after the scan. In Enforce mode with Redact, reviewers read redacted text. In Observe mode the page warns Captured prompts will not be redacted: a captured turn is stored exactly as the caller sent it.
• Capture keeps what the scan passed, so it needs a scanner. With no scanner installed, the page warns Nothing will be captured, and saving a higher capture rate is refused with Capture was not turned on. The rest of the policy is not saved either in that case.
• Captured turns are deleted when their retention window closes: 30 days unless a platform administrator sets another window. See Data retention.
• Turning capture on or changing its rate is recorded on the audit trail.

What you see

From top to bottom:

1. The header, with the tenant picker on the right. A tenant member sees only their own tenant.
2. Notices, when they apply: the scanner notice, a load error, the Read-only notice.
3. Enforcement mode: Observe — detect and audit only (nothing is blocked or changed) or Enforce — redact PII and block unsafe content.
4. Detectors: the PII detection switch with its On PII (enforce) action, the Prompt-injection detection, Toxicity detection and Secret / credential detection switches, the Banned topics (comma-separated) field, and the On unsafe content (enforce) action. The two action menus are available only in Enforce mode, and On PII (enforce) only while PII detection is on.
5. Review capture.
6. Apply to.
7. Save policy, with Saved after a successful save and Updated followed by the time of the last change.

What you can do

Change the policy

1. Open Govern › Guardrails. A platform administrator first picks the tenant.
2. Choose the Enforcement mode.
3. Under Detectors, switch each check on or off, and choose the two actions.
4. To ban topics, type them in Banned topics (comma-separated), for example politics, legal advice. Leave the field empty to switch the check off. A Latin comma or an Arabic comma (،) separates topics.
5. Under Apply to, check User prompts (input), Model answers, or both.
6. Select Save policy.

The new policy applies to the next request. If you leave the page with changes that are not saved, Olympusx AI asks first. If the save fails, your changes stay on the page and The policy was not saved explains why.

Turn on review capture

1. Make sure the page does not show Guardrails service not configured.
2. Decide what reviewers should read. For redacted text, set Enforce mode with PII detection on and On PII (enforce) set to Redact.
3. In Keep 1 request in every, enter the sampling rate, for example 20.
4. Select Save policy.

To stop capturing, set the value to 0 and save. Lowering capture is always accepted.

Default policy

A tenant that has never saved a policy runs this one:

Setting	Default
Enforcement mode	Observe
PII detection	On, On PII (enforce) = Redact
Prompt-injection detection	On
Toxicity detection	On
Secret / credential detection	On
Banned topics	None
On unsafe content (enforce)	Block
Apply to	Both input and output
Keep 1 request in every	0 (off)

Limits

Limit	Value
Policies per tenant	1
Keep 1 request in every	0 to 1,000,000
Default retention of captured turns	30 days
Scanner response time before a scan counts as failed	15 seconds

Related

• Guardrails concepts
• Audit, where every finding and policy change is recorded
• Review queue
• Settings, for the platform’s failure setting
• Developer keys