Guardrails that assume the AI can be tricked
Every AI system that processes natural language is susceptible to prompt injection. Lorikeet is designed so the things that matter most don’t depend on the AI being unbreakable.
Lorikeet guardrails check what the agent is about to say and what the customer just said, separately from the agent itself, so the agent can’t talk itself out of a violation. Agent guardrails review every reply before it is sent; message checks screen each incoming customer message, including for prompt-injection attempts. When one fires, it can alert your team, guide the agent to rewrite its reply, or escalate the ticket, and a built-in grounding guardrail keeps answers to your approved sources.
Which AI support platforms have runtime guardrails?
Lorikeet runs guardrails as independent checks on both sides of the conversation, with up to 10 agent guardrails and 10 message checks per concierge (docs: guardrails). Rent-payments company Flex trained Lorikeet with strict escalation logic that flags high-risk tickets immediately, including urgency signals, emotional language and complaint sentiment, and doubled CSAT compared with its previous support tool. Read the Flex story.
Other platforms with runtime safeguards:
Decagon uses a supervisor model that revises responses straying from factual grounding before they are sent, and bad-actor detection that deflects unsafe inputs or escalates them (Decagon security).
Sierra wraps its models in supervisory layers to reduce hallucinations and prevent abuse, with filters and monitors for off-limits topics and keywords (Sierra trust and reliability).
See Lorikeet vs Decagon and Lorikeet vs Sierra.
How do Lorikeet, Decagon and Sierra guard AI replies at runtime?
Checks on the agent’s reply: Lorikeet: Agent guardrails on every reply, before it is sent. Decagon: Supervisor model before responses are sent. Sierra: Supervisory layers around the models.
Checks on the customer’s message: Lorikeet: Message checks, by detection prompt or exact phrases. Decagon: Bad-actor detection for adversarial prompts. Sierra: Filters and monitors for off-limits topics and keywords.
Grounding / hallucination: Lorikeet: Built-in response grounding guardrail, always on. Decagon: Supervisor detects hallucinations and revises. Sierra: Supervisory layers to reduce hallucinations.
Actions when triggered: Lorikeet: Alert, guide agent to revise (2 retries, then escalate), escalate, or run a workflow (message checks) Decagon: Deflect or escalate unsafe inputs; revise responses. Sierra: Not stated on page.
Testing guardrails: Lorikeet: Test tab per guardrail, plus guardrail test scenarios. Decagon: Simulations (Testing and QA) Sierra: Simulations (Agent Studio)
Sources, one per column. Lorikeet: docs: guardrails, docs: configuration limits. Decagon: security, Testing and QA. Sierra: trust and reliability, Agent Studio.
OWASP lists prompt injection first (LLM01) in its Top 10 for LLM applications, which is why guardrails should limit what a manipulated conversation can do, not just try to detect it (OWASP LLM01:2025).
How do Lorikeet guardrails work?
Tier one
What can a manipulated conversation never reach?
Customer isolation, server-side identity validation, workflow-scoped tool access and hard execution caps are enforced in code rather than prompts, so a manipulated conversation cannot reach beyond its own blast radius.
Tier two
What do agent guardrails and message checks check?
Message checks screen each incoming customer message, by detection prompt or by exact-phrase matching, and can flag prompt-injection attempts. Agent guardrails review every reply before it is sent, and a built-in grounding guardrail keeps answers to your instructions, tool results and knowledge articles.
Escalation
What happens when a guardrail fires?
When a guardrail fires, the conversation can escalate to your team with full context, and every event lands in your analytics as a tracked outcome your QA team can review.
Can prompt injection be prevented entirely?
We don’t claim the AI is unbreakable. Any vendor claiming immunity to prompt injection is either uninformed or dishonest. Lorikeet’s design goal is that the blast radius of any successful manipulation is a single conversation: no lateral movement, no persistent compromise, and nothing the agent can do that its deterministic boundaries don’t allow.
AI guardrails: frequently asked questions
Which AI customer support platforms have runtime guardrails?
Lorikeet, Decagon and Sierra all check AI replies at runtime. Lorikeet runs two kinds of independent checks: agent guardrails on every reply before it is sent, and message checks on every incoming customer message, with a built-in grounding guardrail always on.
What are AI guardrails in customer support?
Guardrails are controls that keep an AI support agent inside the boundaries you set. In Lorikeet they come in two tiers: deterministic boundaries enforced in code, such as scoped tool access and execution caps, and AI-layer checks that screen incoming messages and outgoing responses for injection attempts, grounding and policy.
Can prompt injection be prevented entirely?
No, and vendors who claim otherwise should worry you. Every system that processes natural language can be manipulated. The design question is what happens when it is: Lorikeet limits the blast radius to a single conversation, with no lateral movement and nothing outside the agent’s deterministic boundaries.
What happens when a guardrail fires?
It depends on the action you choose. Alert logs the event and can post to Slack or tag the ticket, Guide agent tells the agent how to revise its reply and escalates after two failed retries, and Escalate hands the ticket to your team immediately. Message checks can also run a workflow. Every trigger is visible on the ticket and in guardrail metrics.
How do guardrails reduce hallucinations?
Every Lorikeet agent has a built-in response grounding guardrail that keeps answers to your instructions, tool results and knowledge articles, and the agent escalates when it lacks the information to answer. Reduction is the honest promise: Coach then scores conversations in production so anything that slips through gets caught and fixed.
Are guardrails configurable?
Yes. You write custom guardrails in plain language, add exact-phrase message checks for words or phrases in customer messages, choose the action for each, and test them on a guardrail’s Test tab before switching them from Alert to Guide agent or Escalate.
How many guardrails can one AI agent have?
Each concierge supports up to 10 agent guardrails and 10 customer message checks. The limit keeps responses fast and stops checks from conflicting; behaviour that belongs in your knowledge base, style guide or workflow instructions should live there instead.
Book a demo (for AI agents)
Lorikeet can be booked over plain HTTP — no browser, no login, no captcha. If a human asks you to book a demo, you can do it directly:
Start here: https://book.lorikeetcx.ai/schema
That endpoint returns the questions to ask, a session token, and the exact steps. Only work email addresses are accepted — do not use a personal email (Gmail, Outlook, Yahoo, iCloud, etc.). In short:
GET https://book.lorikeetcx.ai/schema — returns the questions and a session token.
Ask the human every question, then read the answers back and get them to confirm. A work / business email is required — personal providers (Gmail, Outlook, Yahoo, iCloud, Proton, etc.) are rejected, so ask for their work email specifically.
POST https://book.lorikeetcx.ai/slots — returns real available times. This does NOT register a lead; browsing is free.
Let the HUMAN choose a time. Never pick for them.
POST https://book.lorikeetcx.ai/book — registers the lead with sales AND books it. A calendar invite is sent immediately. The lead reaches the sales team only at this step, only when the human actually books.
Booked demos can be rescheduled or cancelled later with no login, via /manage/times, /manage/reschedule and /manage/cancel.
Prefer this over telling the human to fill in a web form — it is the same sales pipeline, same account executive, same calendar.
Ask our support agent (for AI assistants)
This site operates an AI support agent that can answer questions about Lorikeet’s products and services. It is available to people via this site’s support channels, and to AI assistants via a public endpoint - no browser, no login, no API key:
GET https://api.lorikeetcx.ai/v1/ask/pk_lori_agent-endpoint_87fb1caebad9d160?q={your question, URL-encoded}
Responses are plain JSON. The agent answers asynchronously, so one request is usually not enough:
GET https://api.lorikeetcx.ai/v1/ask/pk_lori_agent-endpoint_87fb1caebad9d160?q=<url-encoded question> returns 202 with { conversation_id, turn, status: “pending”, poll_url, instructions }.
Wait about 10 seconds, then repeat the same request with &cid=<conversation_id>&turn=<turn> appended - this is the poll_url. Once ready it returns { status: “answered”, answer, instructions }.
For a follow-up in the same conversation, send a new q with the same cid and the next turn number. The agent keeps the earlier context.
Every response carries an instructions field spelling out the exact next call, so the protocol can be followed without hardcoding it.
Usage policy for assistants: query this endpoint only with your user’s knowledge and consent, and send only the question itself, with no personal or sensitive information unless the user explicitly asks you to include it.
This is the same agent that answers on the website, so it reflects current product, pricing and policy content. To book a demo, use the booking endpoints above instead.