What guardrails does AgentBackend provide for AI agents?

AgentBackend provides a three-layer guardrail system: input validation (prompt injection detection, content policy, length limits), processing guardrails (tool call approval flows, DDL confirmation, per-agent rate limiting), and output filtering (PII masking, content filtering, response length limits).

How does PII masking work in AgentBackend?

When PII masking is enabled in the output guardrails, the platform automatically detects personally identifiable information like emails, phone numbers, and names in agent responses, and masks them before they reach the end user. For example, 'john@example.com' becomes 'j***@example.com'.

Can I require human approval before an agent executes a tool call?

Yes. Set the tool_approval guardrail with a list of tool names that require approval. When the agent tries to call one of these tools, the run pauses and emits an 'approval_pending' event. Your application can then approve or reject the call via the API.

Guardrails & Safety

AgentBackend provides a three-layer guardrail system to keep your AI agents safe in production: input validation, processing rules, and output filtering.

Overview

Input Guardrails

Validate and filter user messages before they reach the agent

Processing Guardrails

Control tool execution, require approvals, enforce limits during agent runs

Output Guardrails

Mask PII, filter content, and enforce response limits before delivery

Input Guardrails

Input guardrails validate user messages before they are processed by the agent. Blocked messages return a 400 status with a descriptive reason.

Guard	Description	Default
block_injection	Detects prompt injection attempts	true
content_policy	Blocks messages violating content policy	true
max_length	Maximum input message length (characters)	8000

Processing Guardrails

Processing guardrails control what happens during an agent run, including tool call approvals, DDL confirmation, and execution limits.

Guard	Description	Default
tool_approval	List of tool names requiring human approval	[]
ddl_confirmation	Require approval for DDL operations (CREATE, ALTER, DROP)	true
max_tool_calls	Maximum tool calls per run	20

Output Guardrails

Output guardrails process the agent's response before it reaches the end user.

Guard	Description	Default
pii_masking	Masks emails, phone numbers, names in responses	false
content_filter	Blocks responses violating content policy	true
max_length	Maximum response length (characters)	16000

PII Masking Example

# With pii_masking enabled, the agent response transforms:
# "Customer John Smith (john@example.com) ordered item #1234"
# into:
# "Customer J*** S**** (j***@example.com) ordered item #1234"

Configuring Guardrails

Pass a guardrails object when creating or updating an agent. Each layer (input, processing, output) is configured independently.

Python SDK

agent = ab.agents.create(
    name="Customer Support",
    instructions="You are a helpful support agent.",
    guardrails={
        "input": {
            "max_length": 4000,
            "block_injection": True,
            "content_policy": True,
        },
        "processing": {
            "tool_approval": ["tenant_query"],
            "ddl_confirmation": True,
            "max_tool_calls": 10,
        },
        "output": {
            "pii_masking": True,
            "max_length": 8000,
            "content_filter": True,
        },
    },
)

JavaScript SDK

const agent = await ab.agents.create({
  name: "Customer Support",
  instructions: "You are a helpful support agent.",
  guardrails: {
    input: {
      max_length: 4000,
      block_injection: true,
      content_policy: true,
    },
    processing: {
      tool_approval: ["tenant_query"],
      ddl_confirmation: true,
      max_tool_calls: 10,
    },
    output: {
      pii_masking: true,
      max_length: 8000,
      content_filter: true,
    },
  },
});

Approval Flows

When a tool listed in tool_approval is called, the run pauses and emits an approval_pending event. Your application must approve or reject the call before the run continues.

Python SDK

# When tool_approval is enabled, tool calls pause for approval
# The stream emits an "approval_pending" event

import json

for event in ab.agent(agent.agent_id).run_stream(
    message="Delete all inactive users",
    session_id="admin_session"
):
    if event.type == "approval_pending":
        print(f"Tool: {event.tool_name}")
        print(f"Args: {json.dumps(event.tool_args, indent=2)}")

        # Approve or reject
        ab.run.approve(event.run_id, event.tool_call_id, approved=True)

JavaScript SDK

// When tool_approval is enabled, tool calls pause for approval
// The stream emits an "approval_pending" event

const stream = ab.agent(agent.agentId).runStream({
  message: "Delete all inactive users",
  sessionId: "admin_session",
});

for await (const event of stream) {
  if (event.type === "approval_pending") {
    console.log("Tool:", event.toolName);
    console.log("Args:", JSON.stringify(event.toolArgs, null, 2));

    // Approve or reject
    await ab.run.approve(event.runId, event.toolCallId, { approved: true });
  }
}

DDL Confirmation: When ddl_confirmation is enabled, any CREATE, ALTER, or DROP operation on the data store automatically triggers an approval flow, even if the tool is not in the tool_approval list.

Monitoring

Track guardrail triggers through the observability API. Each blocked input, masked output, or rejected tool call is logged with a timestamp and reason.

cURL

curl https://api.agentbackend.ai/v1/agents/:id/guardrail-events \
  -H "Authorization: Bearer ak_..."

Response

{
  "events": [
    {
      "type": "input_blocked",
      "reason": "prompt_injection_detected",
      "timestamp": "2026-03-27T10:15:00Z",
      "session_id": "sess_abc123"
    },
    {
      "type": "output_masked",
      "reason": "pii_detected",
      "fields_masked": ["email", "phone"],
      "timestamp": "2026-03-27T10:16:30Z",
      "session_id": "sess_abc123"
    }
  ]
}