LLM Safety Check

Introduction

The LLM Safety Check uses a secondary AI model to evaluate both incoming messages and the agent's response for safety or policy violations, then blocks, redacts, or redirects when a violation is detected.

What it does

The LLM-Based Guard intercepts content at two points during an agent run. Before the main LLM receives the user's messages, the guard assembles a safety-check prompt, calls the guard LLM, and checks whether the response contains the configured Violation Keyword. After the main LLM produces a response, the guard repeats the check on the output text.

The guard LLM is a completely separate model instance from the task's main LLM. You configure it independently with its own model selection, API credentials, and parameters. This separation lets you use a specialized safety model (for example, a Llama Guard variant via OpenRouter) without changing the main agent.

When the violation keyword is found in the guard LLM's response, the guard applies the action you configured:

• Block stops the agent run immediately.
• Sanitize replaces the content with a fixed redaction message and lets the agent continue.
• Redirect jumps execution to another task.

On any network or runtime error with the guard LLM, the guard fails open: it logs a warning and lets the request through without blocking.

When to use it

Use an LLM-Based Guard when the content you need to catch is context-dependent, nuanced, or cannot be expressed as a fixed pattern.

Typical scenarios include the following:

Get started

How to use it

To use the LLM-Based Guard Element, follow these steps:

1. Locate the LLM Safety Check element under the Guards section in the palette.
2. Drag and drop the element into the Drop a guard to here section.
   

Configure Agent Properties

To properly integrate and configure the LLM safetycheck, set the following fields:

• Personalized Names: Specify a name for the LLM safety check.
• Purpose: A label describing what this guard instance does. Not sent to the guard LLM. A plain-language description, for example, Jailbreak prevention.
• Guard LLM: The secondary AI model that evaluates content. Select an LLM service configured in AI Central Config. A safety-classification model is recommended. This field is required.
• Safety Prompt: The prompt sent to the guard LLM. The placeholder \{content\} is replaced at runtime with the text being evaluated. A prompt that instructs the model to evaluate content and respond with a safe or unsafe verdict.
• Violation Keyword: The word the guard looks for in the guard LLM's response. If found, the violation action fires. The check is case-insensitive. A single word or short phrase, for example, unsafe. Default is unsafe.
• On Violation (Required): What happens when any pattern matches. Select Block, Sanitize, or Redirect. This field is required.
  
  • Redirect Task ID: This setting only appears when Redirect is selected. The task to jump to when a violation is detected. Enter the ID of an existing task in this agent. This is a required field.

The default Safety Prompt asks the guard LLM to evaluate the content and reply with exactly safe or unsafe. You can replace this with any prompt that fits your policy, as long as the guard LLM's response contains the Violation Keyword when a violation is detected.

Samples

Evaluate the following content for policy compliance.
The content must not reveal salary figures, performance ratings, or personally identifiable employee information.
Reply with exactly "safe" if the content is compliant, or "unsafe" if it is not.

Content:
{content}

Best Practices

• The guard LLM is separate from the main task LLM. It is configured entirely within this guard's settings, not inherited from the task. This lets you use a cheap, fast safety model while the main task uses a more capable model.
• Fail-open is intentional. If the guard LLM is unreachable or returns an error, the agent continues without blocking. This prevents a guard outage from breaking all agent runs, but it means a misconfigured guard provides zero protection. Verify the guard LLM with a test message before deploying.
• The violation keyword is a substring match. The guard checks whether the guard LLM's entire response contains the keyword anywhere, case-insensitively. Keep the keyword short and distinctive to avoid false positives.
• Sanitize mode uses a fixed replacement string. Unlike the Rule-Based Guard, the LLM Safety Check does not preserve or selectively redact; the entire content is replaced with [Content removed by safety guard] in sanitize mode.
• Both input and output are checked. The guard runs before the main LLM call (on input) and after (on output). A violation on input prevents the main LLM from ever seeing the content.