AI guardrails

The ai-guardrails block checks the text that goes into and comes out of an agent against a policy you store per agent. A check returns allow, redact or block, logs a block or a redaction, and records the guardrail.blocked event. It is a heuristic filter, not a complete defence: pair it with least-privilege tools and review.

better-supabase add ai-guardrails

The log keeps a hash and never the text, so it holds no user content. Only the service role reads or writes the tables.

Set a policyCopy Anchor Link

await guardrails.policies
  .upsert(
    "support",
    "input",
    {
      injection: { action: "block" },
      pii: { action: "redact", kinds: ["card", "iban", "email"] },
      denyTopics: ["weapons", "self-harm"],
    },
    { organizationId },
  )
  .orThrow();

await guardrails.policies
  .upsert(
    "support",
    "output",
    { pii: { action: "redact" }, maxToolDepth: 5 },
    { organizationId },
  )
  .orThrow();

A policy for agent * applies to every agent without its own. A tenant's policy wins over the system policy of the same agent and stage.

flag logs the reasons and lets the text through.

Check and wrapCopy Anchor Link

const verdict = await guardrails
  .check({ agent: "support", stage: "input", text, organizationId })
  .orThrow();

if (verdict.decision === "block") {
  return refuse();
}

guardrailMiddleware(guardrails, { agent }) wraps one model step as a function from the user text and a next(text) that calls the model. It checks the input, passes the redacted text to next, checks the answer and returns the final text, or the refusal with blockedAt. The middleware reads and rewrites text only and never changes a repository Result. A check that cannot run (for example when the database is unreachable) blocks the stage unless you set failOpen. A failed log write never changes the decision.

FunctionsCopy Anchor Link

Without the clientCopy Anchor Link

import "server-only";

import {
  createAiGuardrails,
  rpcTransport,
} from "better-supabase/blocks/ai-guardrails";

export const guardrails = createAiGuardrails({
  transport: rpcTransport(bsb.admin().$client, { schema: "api" }),
  schema: "api",
});