Agentum
Sign inTalk to usJoin the waitlist

Protect sensitive data with guardrails

Open in Agentum

Purpose

Now and then Neda pastes in a customer message that includes an email address or a card number. Guardrails detect personal information in what an agent reads and writes, and remove it, mask it, replace it with a code or stop the run.

Before you start

The custom agent must belong to your current workspace, and you need permission to manage agents. Use made-up examples when you test: never test with real passwords, customer identifiers or card numbers.

Steps

  1. Open "Agents", find your agent under "My agents" and select it. In the window, open "Agent actions" (the three dots) and choose "Edit agent".
  2. Open "Guardrails" and turn the section switch on. While it is off, the rules cannot be edited. The switch alone does not enable any rule.
  3. Under "PII protection rules" you see five built-in rules: "Email address", "Credit card", "IP address", "MAC address" and "URL". For each rule you want, turn on its switch, then choose a strategy: "Redact" (remove the value), "Mask" (hide part of it), "Hash" (replace the value with a code) or "Block" (stop the run when it is found).
  4. For each rule, tick where it applies: "Model input", "Model output" and "Tool results". An enabled rule needs at least one of them.
  5. To catch something else, select "Add custom detector". Enter a "Custom PII type" (a short name, up to 80 characters) and the detector pattern for it (a regular expression, up to 2,000 characters). The new rule starts switched off, with "Mask" and "Model input" selected. Choose its strategy and scopes, then switch it on.
  6. To remove a custom rule, select its trash button. Built-in rules cannot be deleted, only switched off.
  7. Select "Save".

Expected result

Every enabled rule is applied where you ticked it. You can have up to 50 rules, and only one enabled rule for each type.

Troubleshooting

Problem What to do
Rule controls are greyed out Turn on the section switch at the top of "Guardrails".
"Save" fails for a custom rule An enabled custom rule needs a detector pattern that is a valid regular expression and at least one ticked scope. Two enabled rules cannot share a type. An invalid detector pattern can prevent saving even when its rule is off. Correct the pattern, clear it, or remove the custom rule.
A run stops when a value is found The rule uses "Block". Choose "Redact" or "Mask" if you want the run to continue.
Some sensitive data still appears Detection cannot recognize every value. Guardrails do not delete saved chats or stop every outside action.

Was this helpful?