Keep every run under control
Guardrails screen Action Agent turns only after you publish a policy and assign it. They do not run on an ActionFlow graph. Run history is a filtered view.
Checks run only on an assigned agent policy
- 01
Input rules screen the trailing user messages before the model call, and only when that published rule exists. The system prompt, skills, and memory are outside this stage.
- 02
Personal-data redaction is a detector action. A new organization has no guardrail set, and a new agent is not assigned one.
- 03
Output screening runs only when the published policy has output rules. With no output rule, text goes out as produced.
- 04
A published rule can warn, redact, require approval, or block. Approval on input waits for a reviewer. The same action on retrieval, tool input, tool output, output, or artifact fails the turn.
- 05
A block stops that agent reply. It is not the same as a human approval node, which pauses a flow until someone decides.
Human approval is a pause, not an immutable log
- 01
Manual approval nodes pause the run for a person.
- 02
A human approval node pauses that flow until a person decides. That pause is not a guardrail block.
- 03
Run history is a filtered view. Some values are redacted, transformed, or truncated. It is not a copy of every raw input and output.
- 04
Open run history for a filtered view of steps, settled credits, and artifacts. Some fields are omitted, redacted, or truncated.
- 05
Another organization cannot use your key to read your runs. Model and tool calls still go to the providers you selected, on ActionFlows servers.
Where a check can run
A new organization has no guardrail set, and a new agent is not assigned one. Nothing inserts a default personal-data policy. Publish a policy and assign it before you expect a check.
| Where | When | Result |
|---|---|---|
| Agent input | The published policy has an input rule. | The rule can warn, redact, require approval, or block. Approval on input waits for a reviewer. |
| Tool call | The published policy has a tool_input or tool_output rule. | MCP, built-in, database, and named HTTP arguments and results are screened when those rules are published. Knowledge results use the retrieval stage, not tool input. Approval here fails the turn. It does not pause a flow. |
| Agent output | The published policy has an output rule. With no output rule, text goes out as produced. | A block the public stream cannot apply becomes the fixed message An error occurred. |
| ActionFlow graph | Guardrails do not run on the graph. | Use a human approval node when a person must pause that flow. That pause is separate from guardrail approval. |
Security controls you turn on
Bring your own API keys
Bring provider keys when your plan includes that option. Pro lists Bring Your Own API Keys, and Scale includes the previous plan's features. The Enterprise card does not list that line. Authentication payloads are encrypted. Static HTTP headers are not.
Organization-level access
Organization isolation stops another organization from reading your runs with your key. It does not keep model and tool calls inside your company.
Personal data redaction
The personal-data detector can redact email, phone, SSN, and card values when that rule is in a published policy you assigned. It does not run on an ActionFlow graph.
Output rules, when you publish them
With published output rules, a block can stop the reply. A block the stream cannot apply becomes the fixed message An error occurred.
Assigned agent policies
Guardrails screen Action Agent turns when a published policy is assigned. They do not run on an ActionFlow graph.
Secrets, injection, and tool rules
Published rules can cover secrets, prompt injection, and tool calls. Detectors are local pattern checks, not a hosted moderation model. They do not run until the policy is published and assigned.
Filtered run history
History can show steps, settled credits, and artifacts. It redacts some keys and can truncate loop results. The pricing table lists log storage of 30 days on Free, 60 days on Starter, 180 days on Pro, and 1 year on Scale.
Frequently asked security questions
A run spends organization credits. Log storage and other limits follow your plan. See pricing
Assign a policy before you expect a check
Assign a published guardrail when you want checks on an agent. Use a human approval node when a flow must wait. History stays a filtered view for the store time on your plan.