Jev use case · Agent guardrails

Let agents act.
Keep the checks.

Use Jev to add focused judgements around an agent’s inputs, evidence and proposed actions. Your application owns permissions, approval rules and the response when a check is uncertain.

Design your agent checks

Proposed integration pattern · Evaluate on your own traffic

WHERE TO CHECK

Three places an agent needs a second look.

Before a model reads external content, assess whether it contains an instruction trying to redirect the workflow. Before an answer reaches a user, check whether the cited passage supports the claim. Before a tool runs, compare its proposed action with the user’s request.

These are separate questions with separate consequences. TypeSafe’s guardrail cookbook demonstrates screening messages and using probability thresholds to route the result. We would adapt the questions to your policies and measure both missed hazards and unnecessary blocks.

A model check complements access controls. It cannot authorize a refund, grant database access or make untrusted content safe by declaration. Those boundaries belong in code, with a record of who requested each action.

CHECKS WITH DISTINCT JOBS

BEFORE

Input screening

Assess a message or retrieved passage for attempted instruction changes. Keep the original content labelled as untrusted, even when the classifier finds no issue.

DURING

Evidence verification

Compare a proposed claim with the actual source passage. Reject missing evidence in code; ask the model about the relationship between the available text and the claim.

BEFORE EXECUTION

Action review

Check whether an allowed tool action matches the request. Validate identifiers, ownership, argument types and approval status independently before executing it.

A PRACTICAL EXAMPLE

Keep a support agent within its remit.

Imagine an agent that drafts replies and can change delivery preferences. A customer message asks for an address update but includes unrelated instructions to export the account database. The application exposes only the permitted delivery tools; a Jev check can flag the conflicting request for review.

For the reply, a separate check compares its delivery claim with the carrier record. For the address change, code verifies account ownership and asks for the required confirmation. None of these checks should silently substitute for another.

This is a proposed design, not a claim that Jev catches every attack. TypeSafe publishes related examples for classifying retrieved passages and checking citations.

DECISION PATH

PROPOSED AGENT CHECKPOINT

Proposed action

request + evidence
Jev checks

intent · support · risk
Policy gate

allow · review · block
Permission check

identity + scope
Execute & audit

approved actions only

Timeouts and uncertain answers use an explicit fallback. A model’s confidence never grants permission.

MEASURE BOTH SIDES

A guardrail must catch problems without stopping useful work.

Build the evaluation set from representative normal traffic, known bad examples and difficult boundary cases. Report false positives and false negatives separately. An aggregate pass rate hides the difference between an overblocking system and a permissive one.

Test ambiguous phrasing, conflicting evidence, provider errors and unavailable checks. Decide which operations pause for review and which can safely continue through a deterministic fallback. Track the added response time as part of the user’s complete task.

TypeSafe explicitly lists adversarial inputs among the model’s known limitations. Treat a model change as a reason to re-evaluate the policy. Our prompt-injection guide covers the surrounding system controls.

QUESTIONS

QUESTIONS — 3

No. A model can misclassify a request or miss an attack. Use its decisions alongside least-privilege tools, validated arguments, approvals and monitoring.

Yes, when they evaluate the same available state independently. A check that needs a tool result must wait until that result exists.

Use held-out examples and the consequences of mistakes. Different actions need different thresholds; record review load as well as detection quality.

Keep reading