---
title: Guardrails
description: Validate text against policies using a model, and route to pass or fail
---

Ask a chat model whether a piece of text follows your rules, then send the data down a **Pass** or a **Fail** path.

## What it does

Guardrails sends **Text** to the chat model connected to its **Model** slot, together with your **Policy**. The model must answer with a short verdict: passed or not, and a reason.

The node then routes the data:

* When the text complies, the data goes out of **Pass**.
* When it does not comply, it goes out of **Fail**.
* When the model's answer cannot be read as a verdict (extra commentary, broken JSON), the node **fails closed**: the data goes out of **Fail**. A guardrail never lets text through by accident.

## When to use it

* Check an AI-written reply before you post or send it (no personal data, no promises, stays on topic).
* Screen text a user typed or selected before it reaches another AI step.
* Stop a workflow when scraped content is off topic or unsafe.

To sort text into more than two groups, use [Text Classifier](/nodes/builtin/ai/aiagents/textclassifiernode/). For a plain rule that needs no AI (a word is present, a number is above a limit), use [IF](/nodes/builtin/flow/if/).

## Inputs and settings

Fill **Text** with an expression, for example `{{ $input.response }}` to check the reply of an earlier AI node.

Write **Policy** as clear, checkable rules, for example: `No email addresses or phone numbers. No profanity. The text must be about our product's shipping times.` Vague policies give inconsistent verdicts.

## Outputs

What comes out depends on whether something is connected to the node's input:

* **With an incoming connection**, the incoming items are passed on unchanged to **Pass** or **Fail**. The verdict's reason is not added to them.
* **With nothing connected** to the input, the node sends one item `{ text, passed, reason }`, so you can read why the text failed.

## Dependencies and credentials

Connect a chat model such as [Chat OpenAI](/nodes/builtin/ai/aidependencies/llm/openai/) or [Chat Anthropic](/nodes/builtin/ai/aidependencies/llm/anthropic/). Guardrails has no credential of its own: the model node holds the API key.

## Example workflow

1. [Get Selected Text](/nodes/extension/getselectedtext/) reads the customer message you highlighted.
2. [Basic LLM Chain](/nodes/builtin/ai/aiagents/basicllmchainnode/) drafts a reply with **Prompt** `Write a short, friendly reply to: {{ $input.text }}`.
3. Guardrails with **Text** `{{ $input.response }}` and **Policy** `No refunds or discounts may be promised. No personal data.`, with an [Chat OpenAI](/nodes/builtin/ai/aidependencies/llm/openai/) model on **Model**.
4. From **Pass**, [Clipboard Write](/nodes/extension/clipboardwrite/) copies the reply. From **Fail**, [Show Notification](/nodes/extension/shownotification/) tells you to write it by hand.

## Common issues

* **Everything goes out of Fail.** The model probably adds text around its verdict, which counts as a failure. Use a stronger model, or make the policy shorter and more precise. Run the node with nothing connected to its input to see the `reason`.
* **"Dependency model is required".** Connect a chat model to the **Model** slot.
* **"Model not found".** The connected model node is not set up: open it and choose a model and its credential.
* **Verdicts change from run to run.** The policy is open to interpretation. List concrete rules instead of general goals.

## Related nodes

* [Text Classifier](/nodes/builtin/ai/aiagents/textclassifiernode/): sort text into several categories.
* [Sentiment Analysis](/nodes/builtin/ai/aiagents/sentimentanalysisnode/): route by tone.
* [IF](/nodes/builtin/flow/if/): branch on a simple rule, no AI needed.
* [Basic LLM Chain](/nodes/builtin/ai/aiagents/basicllmchainnode/): generate the text you want to check.