22 Guardrails

Guardrails are safety mechanisms to guide and control the behavior of AI agents.

In Oracle AI Data Platform Workbench, guardrails are configured to prevent the generation or consumption of toxic and malicious content by agents. Guardrails also prevent the leakage of personally identifiable information (PII) by the agent. The specific guardrails available in your AI Data Platform Workbench apply to content moderation, prompt injection, and PII.

Note:

Guardrails offered by AI Data Platform Workbench are only available in English.

The Guardrails offered in AI Data Platform Workbench are implemented by the OCI Generative AI service team. See Guardrails for OCI Generative AI. Based on your guardrails configuration, the AI Data Platform Workbench service invokes the Apply Guardrails API within your OCI tenancy.

Guardrails in Visual Flow Canvas

By default no guardrails are applied to your system beyond the model provider’s native safety controls. To add guardrails, you must drag a guardrails node to your agent visual flow builder and connect it to the agent.

A guardrails node can filter traffic between a chat trigger and an agent node, between a supervisor and executor agents, or between agent and tool nodes. For most scenarios, we recommend a single guardrails node between the chat trigger and the agent node. This will ensure that any messages from the incoming user and messages generated by the agent will be filtered through the guardrails.

The guardrails node can only be inserted between:

• A chat trigger node and an agent (supervisor or executor)

What Guardrails are Available?

The diagram below shows a simple interaction between an end user and an agent. In this scenario, all guadrails are applied (content moderation – CM, prompt injection prevention – PI, and PII detection – PII). PI is only applied to the user query.

After the second message issued by the end user, a PI attempt was detected and the user message was blocked following the agent developer’s selected action on PI detection (block).

Content Moderation

Content moderation is a common implementation of guardrails in most generative AI. Unchecked, LLMs can generate harmful content, promote violent, racist, and sexually explicit content. It is imperative to give agent developers full visibility and control over how user interactions with agents are monitored and scanned for potentially harmful content. Content moderation prevents hateful, sexual, violent, toxic, derogatory, or harassment-based content from being considered or generated by the agent. Our guardrails model classifies content along those six categories and flags content that belong to one of those categories.

You can choose to take an action on either the user input query or the model response:

• Block: You prevents the agent from processing the user input and generating a response. Users receive an error response from the agent.
• Inform: You allow the agent to process the user input and generate a response. The agent notifies the user that either the input or the response contained content that met guardrail criteria.
• Allow: You allow processing and/or generating of potentially harmful content by the agent.

The Block action is selected for content moderation when you create an agent. Oracle recommends keeping Block as your guardrail selection for content moderation.

Prompt Injection

Prompt injection guardrails for AI agents are a protective mechanism that detects, prevents, and mitigates malicious or unintended instructions embedded within user inputs. Prompt injection attacks try to override or subvert the agent’s original instructions, policies, or goals by inserting hidden text that tells the model to ignore previous rules, exfiltrate secrets, or execute unauthorized actions.

You can choose the same actions that can take for content moderation: block, inform, or allow. The prompt injection guardrails only apply to the user input query.

• Block: You prevent the agent from processing the user input. Users receive an error response from the agent.
• Inform: You allow the agent to process the user input . The agent notifies the user that the input contained content that met guardrail criteria.
• Allow: You allow processing of potentially harmful content by the agent.

The Block action is selected prompt injection when you create an agent. Oracle recommends keeping Block as your guardrail selection for prompt injection.

Personally Identifiable Information (PII)

The PII guardrails automatically detects, blocks, or mask PII from either the user input queries or the agents responses. This guardrail prevents the agent from exposing sensitive user information in ways that violate privacy regulations or organizational policies.

PII guardrails support four entity types:

• Email
• Telephone number
• Physical address
• Person name

For each one of those four entities, you choose to apply which of of the follow actions your agent takes on the input user query or agent response:

• Block: You prevent the agent from processing the user input and generating a response. Users receive an error response from the agent.
• Inform: You allow the agent to process the user input and generate a response. The agent notifies the user that either the input or the response contained PII.
• Mask: You allow the agent to process the input and generate a masked response. Any PII used is redacted to prevent exposure.
• Allow: You allow processing and/or generating of PII data by the agent.

In a new agent, PII is allowed in both user input and response by default. Oracle recommends you carefully select the guardrail for PII based on your security needs.

Enable Specific Guardrails in a Node

You can choose which guardrails to enable and how each is configured when adding a guardrail node to your visual canvas.

1. Navigate to the agent in your workspace.
2. Drag a Guardrails node from your palette to your canvas.
3. Provide a meaningful name and description for the node.
   
   

   

   
   
4. Toggle a guardrail to enable it and begin configuring. Pressing the toggle again disables the guardrail and its configurations.
   
   

   

   
   
5. Select the needed guardrail configuration for each category.