# Guardrails & safety

> What the AI must never do: forbidden topics, exact-wording answers, identity checks before account talk, and escapes to a human — enforced per agent and per flow.

A front office AI is trusted with real customers, so the interesting question isn't what it *can* do — it's what it will *refuse* to do. Guardrails are configured per agent and per flow, and they're hard rules, not suggestions in a prompt.

## The guardrail toolkit

- **Forbidden topics** — things the AI must not discuss (diagnosis at a clinic, refunds it can't authorize, legal advice). It deflects with wording you approve and offers the human path.
- **Exact wording** — for safety-critical moments a flow step can use *static text*: the plumber's shut-off instructions, the allergy disclaimer, read verbatim every time.
- **Identity before account talk** — [receptionist verification](/docs/doors/ai-receptionist) (SMS code or security questions) gates anything personal; on the web, [verified identity](/docs/developers/identity-verification) does the same for chat.
- **Global human escape** — "let me talk to a person" is caught anywhere, in any flow, and transfers or tickets with the transcript attached. Nobody gets trapped in a loop.
- **Never guess policy** — answers ground in [knowledge](/docs/ai/knowledge); the allergy question gets a ticket to the kitchen, not a confident guess.

## Examples worth copying

| Business | Guardrail |
| --- | --- |
| Clinic | No diagnosis, ever. Symptom talk → careful wording + practitioner call-back ticket. DOB or SMS verification before any records talk. |
| Pizzeria | Never confirm an allergen from memory — take a number, ticket the kitchen. |
| Plumber | "Is water actively leaking?" first; yes → exact shut-off wording + transfer to on-call. |
| Support desk | No refund promises; refund intent → ticket with an honest "a person will confirm this". |

> **WRITE THE ESCAPE FIRST:** Before tuning anything else, make sure the human path works: a transfer number on the phone, a ticket route everywhere else. An AI that can always hand off safely is allowed to be useful everywhere else.