Guardrail Profiles
When a review submission is governed, the questionnaire answers are compiled into a guardrail profile — a structured security policy that CleverGuard enforces on every action the agent takes at runtime.
How profiles are created
Profiles are compiled automaticallyfrom questionnaire answers at governance time. You don't write profiles by hand — the compiler translates your answers into the correct configuration. The compiled profile is stored alongside the submission and attached to the agent.
How profiles are enforced
When an agent is dispatched (creates a CleverGuard session), the active guardrail profile is loaded and injected into the session. CleverGuard enforces the profile at these points:
- Tool calls are checked against the scope section. Blocked tools return error code
-32403. - Model requests are checked against allowed_models. Non-governed models return HTTP 403.
- Content is scanned with the scanner_config settings. Violations trigger the data_handling action (flag/redact/block).
- Rate limits and budget are enforced by the circuit breaker.
- High-risk actions trigger SignedApproval push notifications when configured.
Not every compiled field is an enforcement point. Fields described as advisory in the tables below are recorded on the profile for review and audit export, and no runtime check reads them.
Trust tiers
The guardrail compiler calculates a risk score(0–100) from the questionnaire answers. This score determines the agent's trust tier:
Scanner Config
Controls how CleverGuard scans agent input and output for sensitive content.
| Field | Type | Description | Source |
|---|---|---|---|
| pii | "strict" | "standard" | "off" | PII detection sensitivity level. Strict uses the ML classifier + regex; standard uses regex only. | D1, D2 |
| injection | "strict" | "standard" | "off" | Prompt injection detection. Strict adds LLM-based classification on top of pattern matching. | P1 |
| secrets | "strict" | "standard" | "off" | Secret/credential detection (API keys, passwords, tokens). | D3 |
| toxicity | "standard" | "off" | Toxicity and harmful content detection. | Default |
| presidio_required | boolean | Whether strict ML-based PII scanning is required. | D1, D2 |
| llm_classification_required | boolean | Whether an LLM classifier runs on every input to detect injection attempts. | P1 |
| block_urls_in_output | boolean | Strips URLs from agent output to prevent data exfiltration via URL encoding. | N3 |
| llm_policy | string (optional) | Free-text policy statement injected as a hard constraint into the scanner. | P4 |
Data Handling
Determines what happens when the scanner finds sensitive content.
| Field | Type | Description | Source |
|---|---|---|---|
| input | "flag" | "redact" | "block" | Action taken on sensitive content in agent input. Flag = log only; Redact = mask before forwarding; Block = reject entirely. | D1-D3 |
| output | "flag" | "redact" | "block" | Action taken on sensitive content in agent output. Same options as input. | D5 |
Scope
Defines the agent's allowed tools, models, and network reach. Anything outside this scope is blocked.
| Field | Type | Description | Source |
|---|---|---|---|
| allowed_tools | string[] | Explicit list of tools the agent can call. Wildcards supported (e.g., 'github__*'). | Integration bindings |
| blocked_tools | string[] | Tools explicitly denied, even if they'd otherwise be allowed. | T5 |
| allowed_models | string[] | LLM models the agent may use. Requests for unlisted models return HTTP 403. | T3 |
| allowed_mcp_servers | string[] | MCP servers the agent can access. Set during submission from available integrations. | Integration bindings |
| allowed_skills | string[] | Skills (prompt templates) the agent can invoke. | Integration bindings |
| mcp_tool_filter | Record<server, tool[]> | Per-server tool allowlist. An empty array means all tools on that server are allowed. | Integration bindings |
| tool_permission_level | "read-only" | "read-write" | "full_crud" | Global permission level. Read-only blocks all write/delete tool operations. | T5 |
| external_api_allowlist | string[] | External API endpoints the agent can reach (when T4 = yes). | T4 |
| url_allowlist | string[] | Domains the agent can access. Unlisted domains are blocked. | N1 |
Circuit Breaker
Automatic safety limits that pause or terminate the agent when thresholds are exceeded.
| Field | Type | Description | Source |
|---|---|---|---|
| max_calls_per_minute | number | Rate limit. Agent tasks exceeding this are queued or rejected. | A2 |
| max_duration_minutes | number | Maximum session length. Sessions are terminated when exceeded. | A3 |
| max_errors_before_pause | number | Consecutive errors before CleverGuard pauses the agent and alerts the owner. | A5 |
| budget_limit_usd | number | Monthly spend cap. Agent tasks are suspended when the budget is exhausted. | A1 |
Autonomy
Controls how independently the agent can operate. Fields marked advisory are compiled onto the profile and available for audit export, but are not runtime enforcement points.
| Field | Type | Description | Source |
|---|---|---|---|
| require_watcher | boolean | Advisory — records that the agent was not cleared for unattended operation. There is no idle-pause enforcement; use max_duration_minutes and max_errors_before_pause for automatic pausing. | A6 |
| auto_pause_after_idle_minutes | number | null | Advisory — the idle window that would trigger a pause, recorded on the profile. Nothing acts on it at runtime. | A6 |
| high_risk_actions_require_approval | boolean | If true, actions matching the listed patterns require human approval via SignedApproval before executing. | A4 |
| high_risk_action_patterns | string[] | Tool call patterns that require human approval (e.g., 'delete_customer', 'send_email', 'export_data'). Listed in A4a. | A4a |
| output_review_required | boolean | Advisory — records a regulatory requirement for human review of outputs. It does not gate delivery on its own; use high_risk_actions_require_approval (A4) for an enforced SignedApproval gate. | C3 |
Compliance
Audit, retention, and regulatory compliance settings.
| Field | Type | Description | Source |
|---|---|---|---|
| frameworks | string[] | Active compliance frameworks (soc2, hipaa, gdpr, pci-dss, etc.). | C1 |
| audit_mode | "full_content" | "metadata_only" | What's logged. Full content logs all input/output; metadata logs request metadata only. | C2, D6, N2 |
| retention_days | number | How long DLP events and content logs are retained before deletion. | C4 |
| inter_step_scanning | boolean | If true, output from each workflow step is scanned before being fed to the next. | P2 |
| prompt_leakage_detection | boolean | Monitors agent output for fragments that match the system prompt. | P3 |