---
title: "Guardrails"
subtitle: "Block jailbreaks, unsafe content, and your own rules before a request reaches the model."
---

Guardrails check each gateway request before any provider is called. Respan's classifier reads the newest turn and judges it against every guardrail you turned on. A request that matches is refused, and the model never sees it.

## Turn on guardrails

Open the **Guardrails** tab of the [Gateway page](https://platform.respan.ai/platform/gateway/traffic?tab=guardrails) and turn on the guardrails you want. Each switch saves at once and applies to every gateway request in the organization. Only organization admins can change them.

<img src={"/docs/images/gateway/guardrails-light.png"} className="block dark:hidden" alt="The Guardrails tab: switches for the eight built-in guardrails, four of them on, and a custom guardrail for competitor comparisons" />
<img src={"/docs/images/gateway/guardrails-dark.png"} className="hidden dark:block" alt="The Guardrails tab: switches for the eight built-in guardrails, four of them on, and a custom guardrail for competitor comparisons" />

| Guardrail | Blocks requests that |
|---|---|
| Jailbreak | Try to bypass the agent's instructions or safety controls |
| System prompt leak | Try to extract the system prompt or hidden instructions |
| Unsafe content | Ask for explicit, violent, or otherwise dangerous content |
| Hate | Demean a protected group |
| Self-harm | Express self-harm or suicide intent, or ask for methods |
| Sexual content | Ask for sexually explicit content, or any content involving minors |
| Violence | Ask for graphic violence, or threaten people |
| Illegal instructions | Ask for weapons, drugs, malware, or fraud instructions |

## Custom guardrails

Click **Add custom** and describe what to block in one sentence, such as "The user asks for a competitor comparison". The classifier judges each request against the description, and a match is blocked like a built-in guardrail. An organization can have up to 10.

## What gets checked

| Rule | Detail |
|---|---|
| Input only | The latest user and tool messages, with the system prompt as context. Earlier turns and the model's answers aren't checked. |
| Chat messages only | Requests without chat messages, such as Responses or Gemini requests, aren't checked. |
| Before the provider | A blocked request never reaches a provider, retry, or fallback, so it costs nothing. |
| After PII redaction | With [PII redaction](/docs/ai-gateway/features/pii-redaction) on, guardrails see the redacted text. |
| Fails open | If a check can't finish within 2 seconds or fails, the request goes through and is counted as **Skipped**. |

A blocked request gets `400` with the code `guardrail_blocked` and the names of the guardrails that matched. Classification is probabilistic: it catches most attempts, not all of them.

## Activity

The **Guardrails** tab charts how many requests were checked, **Blocked**, and **Skipped**, and which guardrail blocked them. In **Logs**, each checked request carries `guardrail_outcome` (`passed`, `blocked`, or `skipped`), and a blocked one also carries `guardrail_triggered`. Filter by them to read the blocked inputs.