> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vorel.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Guardrails
> Per-workspace AI safety: hallucination grading, forbidden phrases, the say-guard, and the booking circuit breaker.
Safety policy is set per workspace rather than shipped as one prompt for everyone. A clinic can run
strict, a hospitality workspace can run loose, and neither waits on a release to change it.
## What runs on every reply
Checks every reply for factual claims that nothing supports: prices, hours, availability, contact
details. Deterministic, on the live path, with no model call, so it costs no latency. A second
asynchronous pass catches what the rules miss.
Matches every reply against your forbidden list, which merges your vertical pack's defaults with
anything you add.
Strips reasoning, tool narration and deliberation out of the reply. The customer gets the answer,
never the working out.
Catches a reply that claims an action succeeded when no tool committed it, for example announcing
a confirmed appointment that was never booked.
## Hallucination grading
The grader extracts factual claims from the reply and verifies each one against the evidence
available in that turn: tool results, your active catalog, your configured working hours, and what
the customer already said.
Flag kinds:
| Kind | Fires when |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `unsupported_price` | A price appears that no tool result or catalog entry grounds, within a tolerance. A price the customer introduced first is treated as acknowledgement, not fabrication. |
| `unsupported_hours` | Stated opening or closing times fall outside your configured hours. |
| `unsupported_availability` | A specific available time is asserted that no tool result grounds. |
| `unsupported_contact` | An email, phone number or reference code appears with nothing behind it. Reference codes are high severity, because a customer acts on a fake confirmation. |
| `llm_flagged` | The asynchronous backstop caught something the deterministic rules did not. |
### Threshold
| Threshold | Trips on |
| ---------------- | ---------------------------------------------------- |
| `low` | Any flagged reply |
| `medium` | Medium or high flags |
| `high` (default) | High flags only |
| `never` | Never trips. Flags are still recorded for reporting. |
### Action
| Action | Behaviour |
| ---------------- | --------------------------------------------------------------- |
| `warn` (default) | Log it. High-severity flags raise an internal alert regardless. |
| `handoff` | Drop the reply and route the conversation to a human. |
### Choosing a setting
* **Clinics, legal, financial services:** `medium` and `handoff`. A medium-confidence fabrication
should never reach a customer. You pay for it in handoff volume.
* **Retail and hospitality:** `high` and `warn`. The default.
* **A new workspace still calibrating:** `low` and `warn`. Maximally noisy, so you can see the real
flag distribution before committing to a policy.
## Forbidden phrases
Your list merges two sources: the phrases your [vertical pack](/verticals/generic) ships, and
anything you add.
Matching is case-insensitive substring matching, so `diagnose` catches "I diagnose", "let me
diagnose" and "I cannot diagnose". This is deliberate. Near-misses are usually the model trying to
talk around a term you banned.
| Action | Behaviour |
| ---------------- | ------------------------------------------------------------------------------------------------ |
| `warn` (default) | Log the slip. |
| `block` | Replace the reply with a neutral fallback offering a colleague, and keep the conversation going. |
| `handoff` | Drop the reply and route to a human. |
`block` gives the agent a graceful exit and keeps it in the conversation. `handoff` means a human
must take it from here.
Pack-level forbidden phrases are a floor. You can add to the list, you cannot remove what the pack
ships. This is what stops a clinic workspace accidentally switching off the diagnosis block.
## Confidence calibration
Beyond catching fabrications, the platform tracks whether the agent's confidence matches its
accuracy. An agent that hedges when it is right and asserts when it is wrong is badly calibrated
even if its hallucination rate looks fine. Calibration is reported alongside quality scores.
## Tool containment
Guardrails cover what the agent says. The tool permissions cover what it can do. Turning a tool off
removes it from the agent's surface entirely rather than instructing the agent not to use it. See
[The agent](/agent/overview).
## What is not a guardrail
* **Profanity filtering.** Add terms to your forbidden list if you need them. There is no generic
profanity list.
* **PII redaction in replies.** The agent has no access to another customer's data, so there is
nothing to redact at the reply layer. Redaction applies to exports and audit records instead.
* **Topic restriction.** "Only talk about property, not the weather" is handled by your vertical
pack's redirect copy rather than as a separate guardrail.
## Where flags show up
Flag rates over time appear in [Quality](/quality/overview). For a single answer, the
[explainability panel](/agent/explainability) shows what was retrieved, what the model produced, and
what was delivered after the say-guard rewrote it.
Every guardrail change is recorded with who made it, the previous value and the new one.