What a guardrail is
A named policy that takes a piece of context (a file write, a dependency install, or, in v1, a scanner finding) and returns a verdict with reasoning. Some guardrails are codified rules (fast, deterministic, regex-shaped). Most are LLM-evaluated against the design review's threats, so the verdict is grounded in spec intent, not generic patterns.
Secret detection regex (Layer 1) + LLM-driven (Layer 2) Agentic guardrails scope-containment · audience-aware · system-data OWASP Top 10 injection · auth · access · crypto · components · … · v1 Framework conventions express · django · fastapi · rails · next · spring · v1 Compliance bundles soc2 · pci-dss · hipaa · iso-27001 · v1
Agentic guardrails
A new category specifically for AI agents. They go beyond "don't ship secrets" to constrain agent behavior at the architectural level. Bounded fallback: an agent failing to reach its primary channel cannot quietly escalate to a wider audience. Audience-aware posting: outputs marked internal cannot leak into public surfaces. System-data redaction: env vars, file contents, and infra metadata cannot reach anything network-facing.
Custom guardrails
Define your own in flowrail.yaml. A guardrail is a YAML stanza with a name, a target (write, dep, finding), a natural-language rule, and an enforcement mode. The rule is what the LLM evaluates; FlowRail wraps it with the design review context.
# flowrail.yaml
guardrails:
- id: no-customer-pii-in-logs
target: write
severity: high
enforcement: hard-block
rule: |
Block any write that adds a log statement carrying customer PII
(email, phone, full name, address) without explicit redaction.
Allow log statements that hash or mask the value first.
Enforcement modes
In v1, guardrails get three enforcement modes per workspace, set via the autonomy slider: hard-block (writes denied, agent retries), soft-block (write allowed, finding logged for review), advisory (logged only, no agent feedback). Modes can be set globally, per category, or per individual guardrail.
Self-improving guardrails (v1)
In v1, when a scanner finding escapes a guardrail (the prediction was right but the rule didn't catch the write), the Triage & Feedback agent auto-proposes a tightened version. Three layers of integrity protect against poisoning attacks: rate limiting, false-positive-rate monitoring, and finding-cluster attribution. Auto-merge requires confidence threshold; below it, proposals queue for review.