> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aperium.apps.hillspire.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How guardrails enforce today

> What actually runs in the live turn pipeline, and how it differs from the authoring console.

There are two separate halves to guardrails in v1, and it's important not to
confuse them:

* **The authoring console** ([Policies](/admins/guardrails/policies)) — where
  admins create, toggle, and dry-run-test tenant policies.
* **The runtime** — a fixed set of built-in guardrails wired into the live turn
  pipeline, plus any guardrails a plugin declares.

<Warning>
  **The console and the runtime are not connected yet.** Policies you author in
  the console are **not** read by the runtime in v1. Turning a console policy on
  or off changes nothing about live traffic. The turn-pipeline wire-in ships as a
  separate follow-up.
</Warning>

## What runs in the live pipeline today

The runtime evaluates guardrails at the same three stages the console describes —
input, tool, and output — but from a fixed built-in set, not from your authored
policies:

| Stage      | Built-in that runs       | Behavior                                                                                                | Status             |
| ---------- | ------------------------ | ------------------------------------------------------------------------------------------------------- | ------------------ |
| **Input**  | Prompt Injection Defense | Blocks prompt-injection-shaped inputs                                                                   | Always on          |
| **Tool**   | High-Risk Tool Approval  | Requires confirmation before high-risk or destructive tools, unless the actor holds `approve:high_risk` | Always on          |
| **Output** | PII Redaction            | Redacts email, phone, SSN, and credit-card shapes to `[REDACTED_*]` markers                             | **Off by default** |

### PII redaction is off by default

The output-side PII redaction backstop is installed only when the deployment
sets `RUNTIME_PII_REDACTION_ENABLED` (default **off**). Most deployments run
without it. When enabled, matches not in the source-aware allowlist are rewritten
to markers like `[REDACTED_EMAIL]`.

<Note>
  All three built-ins are regex-based. Detection is deliberately conservative:
  false negatives (a missed match) are possible, so these are a backstop, not a
  guarantee.
</Note>

## Plugin-declared guardrails

Beyond the host built-ins, a plugin can declare its own guardrails scoped to a
specific capability. Those fire **only** on the capability that declared them —
not as universal rules across every tool. This is how a connector ships its own
tool-level safety check without affecting unrelated capabilities.

## How this maps to the console

| Concept                 | Console (authoring)                              | Runtime (live today)                                   |
| ----------------------- | ------------------------------------------------ | ------------------------------------------------------ |
| Prompt Injection        | Selectable built-in, off unless you add a policy | Always enforced at input                               |
| High-Risk Tool Approval | Selectable built-in                              | Always enforced at tool stage                          |
| PII Redaction           | Selectable built-in                              | Enforced only if `RUNTIME_PII_REDACTION_ENABLED` is on |
| Your tenant policies    | Stored, toggled, dry-run-tested                  | **Not read yet**                                       |
| Plugin guardrails       | Not shown in the console                         | Enforced per declaring capability                      |

<Info>
  A UI feature flag (`enableGuardrails`) exists but defaults off and gates
  nothing structural; the tab's visibility is governed by the `guardrail.read`
  capability. There is no platform-wide `GUARDRAILS_ENABLED` switch. The only
  runtime toggle that changes enforcement is `RUNTIME_PII_REDACTION_ENABLED`.
</Info>

## Fail-safe behavior

When guardrail evaluation exceeds its timeout, the runtime fails **closed** — the
turn is blocked rather than allowed through unchecked. Beyond the timeout case,
how a decision is applied depends on the stage's integration.