Trust & safety

Guardrails

Guardrails inspect the content flowing through an agent — not just which tool runs. They withhold prompt-injected tool output, block jailbreaks and secret leakage, and redact PII.

Turn them on

guard.py
Antraft.agent(model, tools, task="...", guardrails=True).build()

The default stack:

GuardDirectionAction
Jailbreakinputblock
Secret / API keybothblock
Prompt injectiontool outputsanitize (withhold)
PIIbothredact
Note
Blockers run before sanitizers, so a sanitizer can't rewrite text out from under a blocker. Injection is screened on tool output — the #1 agent attack vector (poisoned pages/MCP results).

Custom stack

guard.py
from antraft.guardrails import (
    GuardrailEngine, JailbreakGuard, SecretGuard, PromptInjectionGuard, PIIGuard,
)
from antraft.guardrails.base import Action
 
engine = GuardrailEngine([
    JailbreakGuard(action=Action.BLOCK),
    SecretGuard(action=Action.BLOCK),
    PromptInjectionGuard(action=Action.SANITIZE),
    PIIGuard(action=Action.SANITIZE),
])
 
Antraft.agent(model, tools, task="...", guardrails=engine).build()

LLM classifier

For fuzzy categories (toxicity, self-harm, nuanced jailbreaks), add an LLM-backed guard:

guard.py
from antraft.guardrails import default_guardrails, GuardrailEngine, LLMGuard
 
engine = GuardrailEngine(default_guardrails() + [LLMGuard(model)])

Measured recall

The default heuristics are fast and zero-cost. Effectiveness is measured and enforced in CI by an adversarial red-team suite: injection recall ≥ 80%, jailbreak ≥ 85%, zero secret leaks, and zero false-blocks on benign input. For higher recall, layer in the LLM classifier.

Next →
Memory