Guardrails | Respan Docs

Guardrails check each request you send through the Respan gateway with span-01, Respan’s classification model. You pick the categories to block once for your organization, with no code changes.

Turn on guardrails

Send your requests through the gateway

Guardrails run inside the gateway, so they only cover requests sent through it. Apps that only send traces to Respan aren’t checked. To set up the gateway, see the gateway quickstart.

Turn on blocking

Go to Gateway › Routing config › Guardrails and turn on Block unsafe requests. This blocks all eight categories. Only organization admins can change this setting.

Choose the categories to block

Open the Block menu under the switch, check the categories you want, and click Save.

Guardrails apply to every gateway request in your organization. There’s no per-key or per-request setting. To turn them off, switch off Block unsafe requests and click Disable.

Categories

Category	Blocks requests that
Jailbreak / prompt injection	Try to override the agent’s instructions or safety controls
System prompt leak	Try to get the agent to reveal its system prompt or hidden instructions
Unsafe content	Ask for or share seriously harmful content
Hate / harassment	Target people for a protected attribute such as race, religion, or gender
Self-harm	Express self-harm or suicide intent, or ask for methods
Sexual content	Ask for sexually explicit content, or any sexual content involving minors
Violence	Ask for graphic violence, or threaten people
Illegal instructions	Ask how to make weapons, explosives, or drugs, or how to write malware or commit fraud

What gets checked

The newest turn only. Guardrails read the latest user and tool messages after the last assistant message, with the system prompt as context. Earlier turns and model responses aren’t checked.
Redacted text. If PII redaction is on, guardrails see the redacted messages.
Fail open. If the check can’t run, the request goes through and counts as Skipped.

Handle a blocked request

A blocked request never reaches the model. The gateway returns HTTP 400, and the message lists every category that matched:

{
  "error": {
    "message": "Request blocked by guardrail: jailbreak.",
    "type": "invalid_request_error",
    "param": null,
    "code": "guardrail_blocked"
  }
}

That’s the body on chat completions. On passthrough routes such as the Anthropic endpoint, the body is {"detail": "Request blocked by guardrail: jailbreak."}.

To show your own message, catch the error and check its code:

from openai import BadRequestError
try:
    response = client.chat.completions.create(
        model="gpt-5.5",
        messages=messages,
    )
except BadRequestError as error:
    if error.code != "guardrail_blocked":
        raise
    reply = "Sorry, I can't help with that."

Review activity

The Guardrails tab shows the last 7 days (UTC): how many requests were checked, how many Passed, were Blocked, or were Skipped, and the counts Blocked by category. A request can match more than one category.

Guardrail activity for the last 7 days: 21,007 total requests, 20,719 passed, 281 blocked, 7 skipped, a daily stacked bar chart, and blocked counts by category led by Jailbreak / prompt injection

Benchmarks

On a benchmark built from 7 public security datasets, Respan Guardrails post the highest average F1 of the guardrails we tested.

Guardrail quality versus cost. Average F1 across 8 guardrail categories: Span-01 0.637 at $0, TypeSafe Jev 0.627, gpt-oss safeguard 20B 0.621 at an estimated $0.85 per 1,000 checks, Shieldstral 3B 0.590, OpenAI Moderation 0.481 at $0, Azure AI Content Safety 0.377 at $0.89 per 1,000 checks. — Average F1 across the 8 guardrail categories. * Estimated hosted cost.