Rules for Model Requests, Incoming Messages and Tool Results

Part of Security rules.

Model requests

Review Information sent to AI models in the agent’s Current Protection view. It distinguishes no active rules, monitoring, blocking, and mixed responses, and lists published conditions separately from unpublished drafts and authoring availability. Deployment evidence and inspection health remain separate. Review model-request rules opens the existing catalog; authorized administrators can configure a new unsaved Monitor draft, then save and publish explicitly.

A blocked turn includes a safe notice. Authorized reviewers can open its retained finding and historical rule revision. Missing findings or lost access leave a generic notice. Retained context can block later turns; resolving a finding does not remove the context or authorize another request. Earlier requests and exempt evaluators have separate coverage.

Organization-wide rules on covered agent model requests, without model, provider or purpose filters.

• Inspected: Supported message text: instructions, conversation history, replayed tool-call arguments and tool results.
• Unavailable: Recognized image, audio and file parts cannot pass a Block check.
• Unavailable: Oversized inputs, unsupported detector versions and checks that cannot finish are unavailable; Block denies the request.
• Excluded: Security evaluators bypass these rules and apply only their own limited redaction. They may receive information blocked from the working model.
• Excluded: Calls without agent attribution, separate embedding transports, separately supplied tool definitions and schemas are outside this inspection.
• Excluded: Provider internals and opaque downstream model calls are outside this boundary.

Purpose	Existing boundary
Main reasoning	Covered message content when attributed to an Organization agent.
Conversation and step compaction	Covered when agent attribution is retained; no attribution means no model-request screening.
Profile text generation	Covered text completions when agent attribution is retained. Separate image-generation transports are excluded.
Browser reasoning	Covered through the shared attributed completion path. Recognized vision content makes Block inspection unavailable.
Tool search, file reading and other model helpers	Covered only through the shared attributed completion path; other transports remain excluded.
Audit explanations	Organization-only explanations without agent attribution are excluded.
Security evaluators	Exempt from model-request screening.

• Pattern detectors do not recognize all confidential information. No match is not a guarantee that content is safe.
• This inventory describes source-supported boundaries, not observed qualification of every purpose or worker.
• Blocking does not remove stored context or undo earlier disclosures. Resolving a finding does not authorize another request.
• Action protection and model routing do not by themselves prevent information reaching a model.

A Model requests rule inspects supported message text in covered agent requests to its model gateway (instructions, conversation history, tool-call arguments, and tool results) before the request leaves the platform. It supports payment-card, credential, identifier and marking (when the detector library is open), and custom regular-expression detectors, without conditions. In Block mode, a match or unavailable check stops the request; it is never retried with another provider, and the agent's current work stops. Requests that include images, audio, or files cannot pass a Block check. Content that stays in the agent's context is refused again on later work until it leaves context or the rule changes. Monitor permits dispatch and records eligible findings, suppressing repeated values for the same agent and rule revision within the repeat window. An API request blocked this way stays blocked.

When an outgoing-content or tool-call rule matches, the finding and run timeline state that the matched content was already sent to a model provider only when that same value was recorded in an earlier model request in the same run. The statement names the gateway and the provider that served it. Otherwise no statement is made.

Text/JSON content and UTF-8 text, CSV, and JSON attachments are supported within a 1 MiB inspection limit. Unsupported, oversized, or unreadable required attachments produce an unavailable check. This release does not inspect images, archives, or the internal actions of remote systems.

Web chat, MCP, and peer message attachments retain the file bytes checked before publication. Editing either agent's working copy does not change a published attachment.

Files shared through platform-generated download links receive the same inspection, including stored shortened links and links in message bodies. New links refer to a specific file version; editing that file makes the old link unavailable. Generate and send a new link to share the updated version. Older links that are not bound to a file version cannot pass a covered Block check.

Platform-inserted credentials are excluded from evaluator inputs. When credentials are inserted into a request body or URL, complete content inspection is unavailable; a structured method or destination condition can still be evaluated when its destination is known. Authentication remains subject to existing credential and provider policies.

While a Block rule is active, ordinary activity previews show generic progress instead of unchecked tool payloads or reasoning. Approved messages remain visible through the normal message flow.

Timeline responses and realtime activity updates also check protection before their final delivery admission. If a policy or input hold changes while a timeline is being assembled or an activity update is queued, that operation shows generic activity even if the restriction has already cleared. A new read can show details again when protection is clear. A response admitted before a later policy change may finish delivery afterward; already received content cannot be recalled. This ordering requires the updated admission writers and chat delivery processes to be deployed together. Live model streaming has separate controls.

Incoming monitoring includes message bodies, subjects, and structured peer payloads. Channel filters classify peer messages as agent and Remote MCP messages as mcp. Monitoring does not quarantine content from the agent or its configured model. Model-provider traffic remains governed by AI-provider policy. See Organization AI Providers.

Incoming messages and returned results

Inbound Block scans alongside initial reasoning. Until every applicable check passes, the agent cannot start tools, apply its own configuration changes, or send content. If the scan finishes first, work continues normally. Otherwise the speculative response is discarded and the agent resumes with fresh context once cleared.

The working model may already have seen the input. This mode controls actions and outgoing content; it does not quarantine input from the configured model. Returned-result blocking also does not undo the tool execution that produced the result.

Prompt-injection signals can monitor these targets but cannot block them; see Prompt-injection signals.

Agent status distinguishes Checking security rules, Paused by security rule, and Security check unavailable. The admission deadline defaults to 60 seconds including queue time. An unavailable check stays paused until corrected and rechecked. New messages and results may still arrive and be scanned, but they do not release earlier holds.

Authorized security reviewers see individual input holds and two actions:

• Recheck input evaluates current policy and currently available source content in a fresh attempt. Use this after fixing an unavailable inspection or changing policy.
• Allow this input once requires a reason and allows the explicitly identified matching rule revisions for that exact unchanged occurrence. It also covers subsequent use of that occurrence. Future messages, changed content, new revisions, and outgoing actions still follow policy. Every other applicable check must pass.

Use Load more holds to reach additional occurrences when the Organization has more than 100 outstanding holds. You can review a later input while earlier inputs remain paused.

Allowances are available only for completed, inspectable matches. Missing content, unsupported files, inspection errors, and malware restrictions require correction and rechecking. Review requires the existing security-finding triage permission and recent authentication. A stale review is rejected so the reviewer can reload the current input and policy. Assigning, acknowledging, or resolving a finding does not release execution. The agent resumes only after every outstanding hold clears.

Back to Security rules.