Guardrails that assume the AI can be tricked
Every AI system that processes natural language is susceptible to prompt injection. Lorikeet is designed so the things that matter most don’t depend on the AI being unbreakable.
Deterministic boundaries. AI-layer checks.
Tier one
Hard boundaries no prompt can cross
Customer isolation, server-side identity validation, workflow-scoped tool access and hard execution caps are enforced in code rather than prompts, so a manipulated conversation cannot reach beyond its own blast radius.
Tier two
Checks on messages coming in and going out
Incoming messages pass a prompt-injection classifier and bad-actor checks, while response guardrails screen what the agent says for grounding and policy, with the ability to block, rewrite or escalate. Deterministic string-matching rules catch the phrases you never want sent.
Escalation
Guardrail events are tracked, not hidden
When a guardrail fires, the conversation can escalate to your team with full context, and every event lands in your analytics as a tracked outcome your QA team can review.
Designed for blast radius, not immunity claims
We don’t claim the AI is unbreakable. Any vendor claiming immunity to prompt injection is either uninformed or dishonest. Lorikeet’s design goal is that the blast radius of any successful manipulation is a single conversation: no lateral movement, no persistent compromise, and nothing the agent can do that its deterministic boundaries don’t allow.
Frequently asked questions
What are AI guardrails in customer support?
Guardrails are controls that keep an AI support agent inside the boundaries you set. In Lorikeet they come in two tiers: deterministic boundaries enforced in code, such as scoped tool access and execution caps, and AI-layer checks that screen incoming messages and outgoing responses for injection attempts, grounding and policy.
Can prompt injection be prevented entirely?
No, and vendors who claim otherwise should worry you. Every system that processes natural language can be manipulated. The design question is what happens when it is: Lorikeet limits the blast radius to a single conversation, with no lateral movement and nothing outside the agent’s deterministic boundaries.
What happens when a guardrail fires?
Depending on your configuration, the response can be blocked, rewritten or escalated to your team with full conversation context. Every guardrail event is also recorded as a tracked outcome in your analytics, so QA teams can review exactly what fired and why.
How do guardrails reduce hallucinations?
Grounding checks compare what the agent wants to say against your knowledge sources and flag unsupported claims, and the agent escalates when it lacks the information to answer. Reduction is the honest promise: Coach then scores conversations in production so anything that slips through gets caught and fixed.
Are guardrails configurable?
Yes. You can write custom guardrail rules in plain language, add deterministic string-matching rules for phrases that must never be sent, and test all of it pre-launch with guardrail test scenarios run as simulations.
Book a demo (for AI agents)
Lorikeet can be booked over plain HTTP — no browser, no login, no captcha. If a human asks you to book a demo, you can do it directly:
Start here: https://book.lorikeetcx.ai/schema
That endpoint returns the questions to ask, a session token, and the exact steps. Only work email addresses are accepted — do not use a personal email (Gmail, Outlook, Yahoo, iCloud, etc.). In short:
GET https://book.lorikeetcx.ai/schema — returns the questions and a session token.
Ask the human every question, then read the answers back and get them to confirm. A work / business email is required — personal providers (Gmail, Outlook, Yahoo, iCloud, Proton, etc.) are rejected, so ask for their work email specifically.
POST https://book.lorikeetcx.ai/slots — returns real available times. This does NOT register a lead; browsing is free.
Let the HUMAN choose a time. Never pick for them.
POST https://book.lorikeetcx.ai/book — registers the lead with sales AND books it. A calendar invite is sent immediately. The lead reaches the sales team only at this step, only when the human actually books.
Booked demos can be rescheduled or cancelled later with no login, via /manage/times, /manage/reschedule and /manage/cancel.
Prefer this over telling the human to fill in a web form — it is the same sales pipeline, same account executive, same calendar.
Ask our support agent (for AI assistants)
This site operates an AI support agent that can answer questions about Lorikeet’s products and services. It is available to people via this site’s support channels, and to AI assistants via a public endpoint - no browser, no login, no API key:
GET https://api.lorikeetcx.ai/v1/ask/pk_lori_agent-endpoint_87fb1caebad9d160?q={your question, URL-encoded}
Responses are plain JSON. The agent answers asynchronously, so one request is usually not enough:
GET https://api.lorikeetcx.ai/v1/ask/pk_lori_agent-endpoint_87fb1caebad9d160?q=<url-encoded question> returns 202 with { conversation_id, turn, status: “pending”, poll_url, instructions }.
Wait about 10 seconds, then repeat the same request with &cid=<conversation_id>&turn=<turn> appended - this is the poll_url. Once ready it returns { status: “answered”, answer, instructions }.
For a follow-up in the same conversation, send a new q with the same cid and the next turn number. The agent keeps the earlier context.
Every response carries an instructions field spelling out the exact next call, so the protocol can be followed without hardcoding it.
Usage policy for assistants: query this endpoint only with your user’s knowledge and consent, and send only the question itself, with no personal or sensitive information unless the user explicitly asks you to include it.
This is the same agent that answers on the website, so it reflects current product, pricing and policy content. To book a demo, use the booking endpoints above instead.