product / 02 · guardrails
Rules the model cannot talk its way past.
Guardrails are policy checks that sit outside the model. They validate tool arguments against a schema, limit which tools an agent may touch, screen inputs and outputs for PII, and put hard caps on tokens and spend. Each policy runs in observe, dry-run, or enforce mode, so you can watch what it would block before you let it block.
reading the figure
What you are looking at
-
The policy file is plain YAML: a $500 refund ceiling, two allowed currencies, a schema, and two screens.
-
The model tries a $1,240 refund. The runtime blocks the call before it reaches the refunds API.
-
The block escalates to a person and becomes a new eval case, so the edge case is tested from now on.
how it works
Three steps, one trace.
-
step 01
Observe
Checks run on live traffic and log what they would block. Nothing is stopped yet.
-
step 02
Dry-run
Would-have-blocked verdicts reach reports and alerts, so your reviewers rehearse the real workflow.
-
step 03
Enforce
Blocks are real. The on_block branch runs, and every block is recorded in the trace.
capabilities
What guardrails gives you
02.1
Tool allowlists and argument schemas
An agent can only call tools on its manifest, and every argument payload is checked against a JSON Schema before the call executes. Out-of-schema writes never reach your systems.
02.2
Input and output screens
Fast classifier checks (about 40 ms p95, run in parallel with the step) for PII, prompt injection, and off-policy content. Priced per check, at cost.
02.3
Budget caps that actually stop runs
Per-run and per-workspace ceilings on tokens, spend, and wall-clock time. The runtime enforces them: the step that would exceed the cap never executes.
02.4
Observe, then dry-run, then enforce
Ship a policy in observe mode, read the would-have-blocked report for a week, then flip to enforce with a one-line change. Every flip lands in the audit trail with a name on it.
when teams reach for it
Where it pays off first
- Agents that can write to billing, pricing, or customer records
- Support bots that see personal data in tickets
- Any fleet where a runaway loop could burn a month of budget overnight
- Teams that need an audit trail before legal or security will sign off
What it costs
sample pricingStructural checks free, screens at cost
Schema checks, allowlists, and budget caps are always on and free. Classifier screens cost $0.08 per 1,000 checks. A standard setup is 2 checks per run; strict is 2 per model call.
questions
Guardrails, answered plainly
Do guardrails slow my agent down?
Barely. Structural checks take close to zero time. Classifier screens take about 40 ms at p95 and run alongside the step wherever the answer is not needed to continue.
What if the screening service itself is down?
You decide per policy. Fail-closed holds the step until the check can run, which suits write paths. Fail-open lets the step continue and flags it in the trace, which suits read-only paths.
Can a clever prompt get around a guardrail?
Not a structural one. Schemas, allowlists, and budget caps are enforced by the runtime, not the model, so no wording changes them. Classifier screens reduce risk but are not perfect, and we publish their error rates.
$ trellis estimate --honest
Try guardrails on a real workflow.
Price the stack in the configurator, then bring one of your own workflows to a demo. We'll trace it live and show you this module on your data.