Skip to main content

Crate adk_guardrail

Crate adk_guardrail 

Source
Expand description

§adk-guardrail

Guardrails framework for validating agent inputs and outputs.

§Overview

Guardrails run in parallel with agent execution and can:

  • Block harmful or off-topic content
  • Enforce output schemas
  • Redact PII (emails, phones, SSNs)
  • Limit costs and token usage

§Quick Start

use adk_guardrail::{GuardrailSet, ContentFilter, PiiRedactor};

let input_guardrails = GuardrailSet::new()
    .with(ContentFilter::harmful_content())
    .with(PiiRedactor::new());

let agent = LlmAgentBuilder::new("assistant")
    .input_guardrails(input_guardrails)
    .build()?;

§Tool Guardrails

Guardrail validates Content — a user message or a model response — and never sees a tool call. ToolConfirmationPolicy decides per tool name. Neither can express “this tool may run, but not with these arguments”.

ToolGuardrail receives the tool name and the arguments before the tool executes, and may allow, deny, or narrow them:

use adk_guardrail::{PathAllowList, ToolGuardrailSet};

let tool_guardrails = ToolGuardrailSet::new().with(
    PathAllowList::new("agents-only", ["path"], ["/Users/me/Library/LaunchAgents"])
        .on_tools(["plist_write"]),
);

let agent = LlmAgentBuilder::new("ops")
    .tool_guardrails(tool_guardrails)
    .build()?;

Guardrails run in order and revisions compose, so a later guardrail sees what an earlier one produced. The first denial stops evaluation, and a denial is reported to the model as the tool’s result so it can correct the call rather than the run stalling.

Two implementations ship: DeniedArgumentPattern refuses calls whose serialized arguments match a regular expression, and PathAllowList confines path-valued arguments to a set of roots — comparing by path component, resolving each existing component to reject symlink escapes, and refusing any path with a .. component. It is a preflight check; filesystem tools exposed across a hostile local trust boundary still need platform secure-open primitives to eliminate time-of-check/time-of-use races.

Re-exports§

pub use content::ContentFilter;
pub use content::ContentFilterConfig;
pub use error::GuardrailError;
pub use error::Result;
pub use executor::GuardrailExecutor;
pub use executor::GuardrailSet;
pub use pii::PiiRedactor;
pub use pii::PiiType;
pub use schema::SchemaValidator;
pub use tool::DeniedArgumentPattern;
pub use tool::PathAllowList;
pub use tool::ToolCallDecision;
pub use tool::ToolGuardrail;
pub use tool::ToolGuardrailResult;
pub use tool::ToolGuardrailSet;
pub use traits::Guardrail;
pub use traits::GuardrailResult;
pub use traits::Severity;

Modules§

content
error
executor
pii
schema
tool
Guardrails for tool calls.
traits