> For the complete documentation index, see [llms.txt](https://docs.maiagent.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.maiagent.ai/tech/en/advanced-genai-tech/guardrails.md).

# AI Guardrails

MaiAgent's AI safety mechanisms: customer-configurable Hook message interception (personal data masking, content safety classification, and more), along with ICAP content validation and AWS Bedrock Gu

MaiAgent provides several safeguards along the path where content enters and leaves large language models. The system enforces them without relying on the model's self-discipline. This page explains who configures each mechanism, where it applies, and when to use it. Refer to the user manual for steps in the admin console.

## Mechanism Overview <a href="#overview" id="overview"></a>

| Mechanism                                                                          | Who Can Configure It                                                         | Where It Applies                                                                          | Suitable Scenarios                                                                                                              |
| ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| [Hook Message Interception](#hook)                                                 | Members with “Hook permissions” configure it themselves in the admin console | Before content enters the model and before AI responses are sent                          | Masking personal data, blocking prompt injection and inappropriate content, filtering sensitive words, and screening responses  |
| [ICAP Content Validation](/tech/en/advanced-genai-tech/icap-content-validation.md) | MaiAgent configures it based on the organization's needs                     | Conversation messages and attachments, and knowledge base files (see that page for scope) | Enterprises with existing ICAP antivirus / DLP services that need to integrate existing security controls                       |
| [AWS Bedrock Guardrails](#aws-bedrock-guardrails)                                  | Only MaiAgent can configure it for an Agent                                  | User input and AI responses                                                               | Scenarios requiring Bedrock Guardrails policies (content filtering, denied topics, personal data masking, and grounding checks) |

The three mechanisms are configured and executed independently. There is no shared policy layer or unified table of “block / alert / allow” rules. Hooks rewrite or intercept content, Bedrock Guardrails blocks or masks it according to its policies, and ICAP allows or rejects files based on scan results. When multiple mechanisms are enabled, content passes through each check separately. If any mechanism blocks the content, it will not be sent to the model or the user. The platform also does not integrate third-party runtime prompt injection protection products (such as WAFs or AI firewalls). If these controls are needed, place them in the network layer between users and MaiAgent, or use Hook prompt injection detection instead.

{% hint style="warning" %}
**System prompts are not security controls.** A system prompt can guide an Agent's tone and response scope, but it is only text sent to the model. The model may be induced to ignore it, and it cannot block passages that have already been retrieved. To ensure that certain content never enters the model or appears in a response, use the mechanisms on this page. To restrict which documents users can retrieve, use [Query Metadata](/tech/en/identity-and-access/zhi-shi-guan-li-quan-xian-query-metadata-cha-xun-yuan-zi-liao-zong-lan.md). For guidance on writing system prompts, see the user manual's [System Prompt Design Guide](https://docs.maiagent.ai/build/agent/system-prompt).
{% endhint %}

## Hook Message Interception <a href="#hook" id="hook"></a>

Hooks are a protection layer that customers can configure themselves. Create a Hook from a template, adjust its parameters, and apply it to an Agent. An Agent can have multiple Hooks, executed in order.

**Prerequisites**: The platform must have the Hook feature enabled, and the organization must have access to Hooks (included automatically in enterprise plans, or enabled individually by MaiAgent). If the Hook menu is not visible in the admin console, contact your MaiAgent representative.

### Trigger Points and Actions <a href="#hook-trigger-points" id="hook-trigger-points"></a>

| Trigger Point                   | Content Checked                                                                                               |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------- |
| Before content enters the model | User messages, attachment content, passages retrieved from the knowledge base, and tool results in Agent mode |
| Before AI responses are sent    | Responses generated by the Agent                                                                              |

There are two actions: **rewrite** (for example, mask personal data before sending) and **intercept** (block the content and reply with a custom message). When attachment content, a knowledge base passage, or a tool result is intercepted, only that content is excluded from the model; the conversation continues.

### Detection Methods <a href="#hook-detection" id="hook-detection"></a>

| Method                                | Description                                                                                                                                                                       | Data Destination                       |
| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
| Rule matching                         | Match patterns or keywords, such as email addresses, mobile phone numbers, national ID numbers, credit card numbers, or specified prohibited words                                | Processed within the MaiAgent platform |
| Large language model assessment       | Use a selected model to assess content, such as whether it is a prompt injection attack or whether a response lacks grounding                                                     | Sent to the selected model             |
| Personal data detection service       | Detect personal data without a fixed format, such as names and addresses; Google Cloud DLP is currently available                                                                 | Sent to the detection service          |
| Content safety classification service | Classify content by categories such as hate, harassment, sexual content, violence, self-harm, illegal activities, and jailbreak attacks; OpenAI Moderation is currently available | Sent to the classification service     |

Personal data detection and content safety classification deduct credits based on the number of characters scanned (per thousand characters). For available templates, each template's parameters, and interception records, see [Hook Message Interception](https://docs.maiagent.ai/build/hook), [Add and Configure a Hook](https://docs.maiagent.ai/build/hook/setup), and [Hook Execution Logs](https://docs.maiagent.ai/build/hook/execution-logs) in the user manual.

## AWS Bedrock Guardrails <a href="#aws-bedrock-guardrails" id="aws-bedrock-guardrails"></a>

AWS Bedrock Guardrails is a protection service provided by AWS. MaiAgent can assign a Guardrail (ID and version) to an individual Agent. That Agent's conversations then pass through the Guardrail checks:

* **User input**: Checked before entering the model. If a blocking rule is triggered, the Guardrail's configured blocking message is returned directly.
* **AI responses**: Checked before sending, together with the question and retrieved passages. If a blocking rule is triggered, the response is replaced with the blocking message. If a masking rule is triggered, the masked content is returned instead.

Usage limitations:

* **Only MaiAgent can configure it**: There is no configuration option in the admin console. The Guardrail must be created in the AWS environment called by the MaiAgent platform. A Guardrail created in the customer's own AWS account cannot be applied directly. Contact your MaiAgent representative if needed.
* **Responses are not streamed token by token**: For an Agent with a Guardrail applied, the entire response is sent after checks are complete.
* Connectivity to AWS Bedrock is required; offline on-premises environments cannot use it.

For scenarios that do not require AWS, prioritize [Hooks](#hook), which you can configure yourself.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.maiagent.ai/tech/en/advanced-genai-tech/guardrails.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.