Guardrails check what the agent is about to say and what the caller says, against topics you choose. A blocked reply is replaced with a fallback message before it is spoken. Find them under Guardrails in the agent's settings panel.
Output topics#
Agent must not talk about lists the topics the agent's own replies are checked against (guardrail_config.output_topics):
| Label | Topic |
|---|---|
| Harassment | harassment |
| Self-harm | self_harm |
| Violence | violence |
| Sexual content | sexual |
| Hate speech | hate |
| Gambling | gambling |
| Regulated advice (legal, medical, financial) | regulated_advice |
The reply is checked sentence by sentence as it streams to the voice. Sentences before the blocked one are spoken; the blocked sentence and the rest of the reply are replaced by the fallback message.
Input checks#
These check what the caller says (guardrail_config.input_topics), before the agent replies:
| Control | Topic | What happens |
|---|---|---|
| Block jailbreak attempts | jailbreak |
Caller instructions such as "ignore your previous instructions", "system prompt" or "pretend you are" are not passed to the model. The agent says the fallback message. |
| End scam calls | scam |
When the caller pushes gift cards, wire transfers, crypto ATMs, remote computer access or poses as a tax office or police, the agent says the fallback message (or "I'm not able to help with this. Goodbye.") and hangs up with disconnection_reason: "scam_detected". |
Through the API, input_topics accepts any topic in the list, so you can also block caller input on, for example, harassment.
Fallback message#
Said instead of a blocked reply (guardrail_config.fallback_message) is spoken in place of blocked content. It supports dynamic variables. When empty, the agent says: "I'm sorry, I can't help with that. Is there anything else I can do for you?"
Repeated blocks end the call#
After 3 blocked turns in one call (input and output combined), the agent finishes its fallback message and hangs up with disconnection_reason: "guardrail_triggered".
How topics are detected#
| Mode | Detection |
|---|---|
| With an OpenAI key | The OpenAI moderation endpoint (omni-moderation-latest) checks harassment, self-harm, violence, sexual and hate. Gambling, jailbreak and scam use keyword rules. Regulated advice uses both. If the moderation call fails, keyword rules are used. |
| Mock mode | Keyword rules only. |
Keyword rules catch clear wording only. Keep instructions about what the agent must not discuss in the prompt as well; guardrails are a safety net, not a replacement.
Order of checks#
On each caller turn, Tried checks, in order: voicemail and IVR detection, do-not-call requests, then input guardrails. Output guardrails run while the reply is being spoken.
Pricing#
Agents with any guardrail topic configured add $0.01 per minute.
Fields#
{
"guardrail_config": {
"output_topics": ["regulated_advice", "gambling"],
"input_topics": ["jailbreak", "scam"],
"fallback_message": "Sorry, that's not something I can help with. Can I help with your booking?"
}
}| Field | Type | Default |
|---|---|---|
guardrail_config |
object or null | null (off) |
guardrail_config.output_topics |
array of topics | [] |
guardrail_config.input_topics |
array of topics | [] |
guardrail_config.fallback_message |
string | not set |
Set guardrail_config with Update agent. Clearing every topic and the message in the dashboard sets it to null.