4.2. Safeguards

Overview

AAS blocks what AI agents do at two points.

Safeguard	What it blocks
Question guardrail	When a question a user sends violates policy, the model is not called.
Dangerous command block	Stops an AI agent from running a command that deletes its own data folder entirely.

The guardrail is a checking service that filters out harmful questions and questions that violate policy. Neither safeguard has a setting in the administrator screens to turn it on or off. The administrator has two jobs. When a user reports a blocked request, work out what blocked it, and ask the operator to check if needed (the operator installs AAS and manages the server, see the A.3. Glossary).

Permissions: Administrators do the checks in this chapter. The operator does any check that requires server logs.

Note: On the "Settings (config)" tab of a profile's details, only administrators can change the command approval (approvals) setting. The owner of an AI Agent Workspace and team managers cannot change it. This setting cannot lift the "Dangerous command block" below. For details, see 3.4. Changing a Profile's Model and Settings on Someone's Behalf.

For the user's side of this topic, see 2.7. When an Answer Is Blocked or Slow in the User Manual.

Question Guardrail

How It Works

When a request arrives for an AAS model whose name starts with cogentai-aas, LiteLLM (a relay server that lets you use many AI models through one address) first sends the user's question to the guardrail. If the guardrail blocks it, the model is not called. A block notice goes back as if it were the AI agent's answer. This works the same way for chat, messenger connections, and scheduled jobs.

The guardrail checks only the following.

• It checks only text from the person who is sending now. It does not check earlier conversation history.
• It does not check text that Hermes and AAS add by themselves. This includes guidance text, skill bodies, tool results, and text that is continued automatically.
• It does not check model answers or tool execution results.

What the User Sees

In the user's chat, the answer area shows a sentence like this.

Sorry, your input violates policy and cannot be processed.

The model did not write this sentence. It is a notice that the guardrail side returns before the model is called. The user reads it as the AI agent refusing to answer. Sending the same text again sometimes passes, because the guardrail does not always give the same verdict.

Limits

These are the limits an administrator should know.

Limit	Description
Guardrail service failure	During a failure or a timeout, questions pass without being checked.
Models that are not AAS models	A model whose name does not start with cogentai-aas does not go through the guardrail. Check for the "Not an AAS model" label in 4.1. Models.
Alias for auxiliary tasks	cogentai-aas-aux is not checked.
Conversation history and personality (SOUL)	Content in earlier questions and in the personality text is not checked.

Checking a Blocked Request

A false positive is a case where the guardrail blocks normal text that does not violate policy. When a user reports "It says my input violates policy and cannot be processed", check in this order.

1. Read the text the user wrote. If it really violates policy, the guardrail worked correctly.
2. If there is no reason for it to be blocked, treat it as a false positive. Ask the user to send it again to see whether the same text keeps getting blocked.
3. If it keeps getting blocked, get the following information from the user.
   • The time of the block
   • Which AI Agent Workspace (the place where an AI agent works, one for each user, see the A.3. Glossary) and which profile
   • Whether it happened in chat, a messenger, or a scheduled job
   • The exact text the user typed
   • The notice sentence that appeared on the screen
4. Collect this information and pass it to the operator. Follow "Asking About a False Positive" below.

Asking About a False Positive

Send the operator all the information from step 3 and the AAS version, and ask for the following checks. These checks require reading server logs, so you cannot do them in the AAS screens.

• Whether the text the guardrail actually checked is the same as the text the user typed
• Which category the guardrail judged it to be. For example, jailbreak is the category for an attempt to make the AI break its rules.
• Whether LiteLLM has a block record at the same time

Note: If the text the guardrail checked is longer than the text the user typed, guidance text that no person typed was checked along with it. The operator finds where that text came from and fixes it.

Dangerous Command Block

How It Works

An AI agent can run terminal commands. A command that deletes its own data folder entirely does not run, whether or not it is approved. It is blocked even if the user clicks "Allow once" on the approval card, even if approvals are turned off, and even if a scheduled job is set to allow automatically. Neither users nor administrators can lift this block from the screen.

The following targets are blocked.

Target	Example
Root, home, and system folders	rm -rf /, rm -rf ~
The whole user Hermes data folder	The folder that holds profiles, conversation history, memory, skills, secrets, and settings
A whole profile	The profile folder
Conversation history, memory, skills, secrets, and settings	Each of their folders or files
The whole work folder and the shared output folder	The entire upload and shared folders

The block also covers a command that writes the path directly, and a command that points to the same folder with a relative path, such as rm -rf * in the work folder.

The following are not blocked.

• Deleting a subfolder or a file inside the work folder: for example, deleting a build folder
• Deleting a relative path that is not in the list above

For commands that are not blocked but look risky, the AI agent first asks the user on an approval card. If the user clicks "Deny", the command does not run.

What the User Sees

When a block happens, three places change in the chat screen.

Place	What is shown
Header of the work step group	A red dot and "{n} steps · blocked by a safeguard"
The blocked tool row	A red dot and "Blocked"
Above the AI agent's answer	A red label "A safeguard blocked a dangerous command" and a one-line reason

The reason appears in English. For example, recursive delete of Hermes data (/opt/data/profiles/example) means "tried to delete the Hermes data entirely". The reason includes the blocked path. The same labels appear when you reopen a past conversation. The red label is attached only to the first answer right after the blocked step.

A command that the user denied directly on the approval card with "Deny" does not get this label.

What the Administrator Checks

When a user reports that "the AI agent could not delete files", check the following.

1. Ask the user about the red label and the reason on the screen.
2. Check whether the blocked path is a target in the table above, such as the data folder, a profile, or the whole work folder.
3. If it is a target, this is normal behavior. If the user wanted to delete a subfolder or a file inside the work folder, tell them to ask again with that path.
4. If the user wants to delete a profile or a workspace, tell them to use the delete function in the AAS screens. For a profile, use "Delete" under "My AI Agents › Profiles". For an AI Agent Workspace, use "Delete" on the "AI Agent Workspaces" screen. Before deleting, save the settings, scheduled jobs, skills, and memory to an export file. To delete a workspace, the user must type its id again.
5. If something that is not a target seems to be blocked, collect the reason and the path and pass them to the operator.

Changing the approval settings does not lift the block above. The block works regardless of the settings file.

Note: This block is built into the user Hermes image. The block rules must be checked when the Hermes version is raised, so after a new image is rolled out, the operator checks that commands that delete the data folder are still blocked. See 3.3. Rolling Out a New User Hermes Image.

Related Documents

• 2.7. When an Answer Is Blocked or Slow (User Manual)
• 3.4. Changing a Profile's Model and Settings on Someone's Behalf
• 4.1. Models
• 3.3. Rolling Out a New User Hermes Image