set({ workspaceIds: next })}
+ options={workspaces.map((workspace) => ({
+ id: workspace.id,
+ label: workspace.name,
+ }))}
+ emptyMessage={
+ isLoadingWorkspaces
+ ? "Loading workspaces…"
+ : workspacesError
+ ? "The workspaces could not be loaded."
+ : "This deployment has no workspaces yet."
+ }
+ countNoun={{ one: "workspace", other: "workspaces" }}
+ isInvalid={value.workspaceIds.length === 0}
+ errorMessage={
+ value.workspaceIds.length === 0
+ ? "Pick at least one workspace."
+ : undefined
+ }
+ reserveMessage
+ />
+
+ )}
+
+ )
+}
diff --git a/web/src/features/tools/GuardrailsPage.test.tsx b/web/src/features/tools/GuardrailsPage.test.tsx
index eb1a264963..32f2f26d63 100644
--- a/web/src/features/tools/GuardrailsPage.test.tsx
+++ b/web/src/features/tools/GuardrailsPage.test.tsx
@@ -135,9 +135,14 @@ function storedGuardrail(
create_secrets: { api_key: "***" },
validate_kwargs: {},
enabled: true,
+ mode: "block",
+ on_unavailable: "block",
+ applies_to_all_workspaces: true,
+ workspace_ids: [],
created_at: "2026-09-16T00:00:00Z",
updated_at: "2026-09-16T00:00:00Z",
decryptable: true,
+ loaded: true,
...overrides,
}
}
@@ -149,6 +154,10 @@ function mockApi({
encryptionAvailable = true,
isOperator = true,
testResult,
+ workspaces = [
+ { id: "ws-1", name: "Platform" },
+ { id: "ws-2", name: "Research" },
+ ],
}: {
stored?: StoredGuardrail[]
catalog?: BuiltInGuardrailSpec[]
@@ -156,6 +165,7 @@ function mockApi({
encryptionAvailable?: boolean
isOperator?: boolean
testResult?: TestGuardrailResponse
+ workspaces?: { id: string; name: string }[]
} = {}) {
const calls: { url: string; method: string; body: unknown }[] = []
vi.spyOn(globalThis, "fetch").mockImplementation(async (input, init) => {
@@ -181,6 +191,9 @@ function mockApi({
calls.push({ url, method, body: undefined })
return Response.json({ guardrails: catalog })
}
+ if (url.includes(`${API_ROOT}/workspaces`)) {
+ return Response.json({ data: workspaces, count: workspaces.length })
+ }
if (url.includes(`${API_ROOT}/organizations/me`)) {
return Response.json(
organizationContext({
@@ -449,10 +462,156 @@ describe("defining a guardrail", () => {
guardrail_name: "lakera_guard",
create_kwargs: { api_key: "lak-123" },
validate_kwargs: {},
+ // The enforcement defaults the form opens with: refuse a flagged
+ // request, refuse one it could not check, and cover every workspace.
+ mode: "block",
+ on_unavailable: "block",
+ applies_to_all_workspaces: true,
+ workspace_ids: [],
+ })
+ })
+ })
+
+ it("stores the enforcement the operator chose rather than the defaults", async () => {
+ const calls = mockApi()
+ const user = userEvent.setup()
+ renderPage()
+ const dialog = await openAdd(user)
+
+ await pickOption(
+ user,
+ "What do you want checked?",
+ "Prompt injection",
+ dialog,
+ )
+ await pickOption(user, "Which guardrail?", /Lakera Guard/, dialog)
+ await user.type(within(dialog).getByLabelText("Api key"), "lak-123")
+ // The fallback first: once the mode is "Report only" the fallback control
+ // has nothing to decide and is disabled.
+ await pickOption(user, "When it cannot answer", "Let it through", dialog)
+ await pickOption(
+ user,
+ "When it flags a request",
+ "Report only, let it through",
+ dialog,
+ )
+ await user.click(
+ within(dialog).getByRole("button", { name: /Add guardrail/ }),
+ )
+
+ await waitFor(() => {
+ const post = calls.find((call) => call.method === "POST")
+ expect(post?.body).toMatchObject({
+ mode: "monitor",
+ on_unavailable: "allow",
+ })
+ })
+ })
+
+ it("sends the workspaces a narrowed definition was pointed at", async () => {
+ const calls = mockApi()
+ const user = userEvent.setup()
+ renderPage()
+ const dialog = await openAdd(user)
+
+ await pickOption(
+ user,
+ "What do you want checked?",
+ "Prompt injection",
+ dialog,
+ )
+ await pickOption(user, "Which guardrail?", /Lakera Guard/, dialog)
+ await user.type(within(dialog).getByLabelText("Api key"), "lak-123")
+ await pickOption(user, "Where it runs", "Chosen workspaces", dialog)
+ await user.click(
+ within(dialog).getByRole("combobox", { name: /Workspaces/ }),
+ )
+ await user.click(await screen.findByRole("option", { name: /Research/ }))
+ await user.click(
+ within(dialog).getByRole("button", { name: /Add guardrail/ }),
+ )
+
+ await waitFor(() => {
+ const post = calls.find((call) => call.method === "POST")
+ expect(post?.body).toMatchObject({
+ applies_to_all_workspaces: false,
+ workspace_ids: ["ws-2"],
})
})
})
+ it("refuses to save a narrowed definition that names no workspace", async () => {
+ // It would check nothing, which is what "Every workspace" is not, and what
+ // switching the row off is for.
+ mockApi()
+ const user = userEvent.setup()
+ renderPage()
+ const dialog = await openAdd(user)
+
+ await pickOption(
+ user,
+ "What do you want checked?",
+ "Prompt injection",
+ dialog,
+ )
+ await pickOption(user, "Which guardrail?", /Lakera Guard/, dialog)
+ await pickOption(user, "Where it runs", "Chosen workspaces", dialog)
+
+ expect(
+ within(dialog).getByRole("button", { name: /Add guardrail/ }),
+ ).toBeDisabled()
+ })
+
+ it("says what each row is doing to traffic, not just that it is on", async () => {
+ // "Running" cannot tell a check that refuses from one that only reports.
+ mockApi({
+ stored: [
+ storedGuardrail({ name: "blocking" }),
+ storedGuardrail({ name: "watching", mode: "monitor" }),
+ storedGuardrail({ name: "paused", enabled: false }),
+ ],
+ })
+ renderPage()
+
+ expect(await screen.findByText("Blocking")).toBeInTheDocument()
+ expect(screen.getByText("Monitoring")).toBeInTheDocument()
+ expect(screen.getByText("Paused")).toBeInTheDocument()
+ })
+
+ it("warns that a definition which did not build is checking nothing", async () => {
+ // The one state that would otherwise be invisible: the row reads as healthy
+ // while traffic goes past it unchecked.
+ mockApi({ stored: [storedGuardrail({ loaded: false })] })
+ renderPage()
+
+ expect(await screen.findByText(/Failed to build/)).toBeInTheDocument()
+ })
+
+ it("says nothing about building for a row that is switched off", async () => {
+ mockApi({ stored: [storedGuardrail({ loaded: false, enabled: false })] })
+ renderPage()
+
+ expect(await screen.findByText("Paused")).toBeInTheDocument()
+ expect(screen.queryByText(/Failed to build/)).not.toBeInTheDocument()
+ })
+
+ it("says which workspaces a definition covers", async () => {
+ mockApi({
+ stored: [
+ storedGuardrail({ name: "everywhere" }),
+ storedGuardrail({
+ name: "narrow",
+ applies_to_all_workspaces: false,
+ workspace_ids: ["ws-1", "ws-2"],
+ }),
+ ],
+ })
+ renderPage()
+
+ expect(await screen.findByText("Every workspace")).toBeInTheDocument()
+ expect(screen.getByText("2 workspaces")).toBeInTheDocument()
+ })
+
it("asks for a JSON argument as switches, with the chosen operation already on", async () => {
const calls = mockApi()
const user = userEvent.setup()
@@ -633,6 +792,10 @@ describe("editing a definition", () => {
endpoint: "https://elsewhere.example",
},
validate_kwargs: {},
+ mode: "block",
+ on_unavailable: "block",
+ applies_to_all_workspaces: true,
+ workspace_ids: [],
expected_updated_at: "2026-09-16T00:00:00Z",
})
})
diff --git a/web/src/features/tools/GuardrailsPage.tsx b/web/src/features/tools/GuardrailsPage.tsx
index b01a87bf56..bb2e30d10b 100644
--- a/web/src/features/tools/GuardrailsPage.tsx
+++ b/web/src/features/tools/GuardrailsPage.tsx
@@ -29,17 +29,23 @@ import {
import { docsSourceHref } from "@/shared/helpers/docs"
// The guardrails this deployment defines, each built and run inside the gateway
-// rather than sent to a separate service. A row's name is what a caller puts in
-// a guardrail entry's `profile` field.
+// rather than sent to a separate service. An enabled row checks every request
+// from the workspaces it covers, whether the caller asked for it or not, and its
+// name is also what a caller may put in a guardrail entry's `profile` field.
//
// Shaped as the providers page is, and for the same reason: this is a list of
// credentialed things an operator adds, edits and removes, not a set of
// settings. Add opens a dialog over the page, the table is the destination, and
// a credential is encrypted at rest and never returned.
-/** Whether the definition's credentials survived the current OTARI_SECRET_KEY. */
+/** What a row is doing to traffic right now, and the switch that stops it. */
function StatusCell({ guardrail }: { guardrail: StoredGuardrail }) {
const update = useUpdateGuardrailDefinition()
+ const state = !guardrail.enabled
+ ? "Paused"
+ : guardrail.mode === "block"
+ ? "Blocking"
+ : "Monitoring"
return (
-
- {guardrail.enabled ? "Running" : "Paused"}
-
+ {state}
)
}
+/** How many workspaces a definition covers, in as few words as say it. */
+function scopeLabel(guardrail: StoredGuardrail): string {
+ if (guardrail.applies_to_all_workspaces) return "Every workspace"
+ const count = guardrail.workspace_ids?.length ?? 0
+ if (count === 0) return "No workspaces"
+ return count === 1 ? "1 workspace" : `${count} workspaces`
+}
+
export function GuardrailsPage() {
const context = useOrganizationContext()
const isOperator = isDeploymentOperator(context.data)
@@ -96,6 +108,14 @@ export function GuardrailsPage() {
Credentials unreadable: check OTARI_SECRET_KEY
)}
+ {/* Enabled and not built means its checks do not run, which is the one
+ state that would otherwise be invisible: the row reads as healthy
+ while traffic goes past it unchecked. */}
+ {row.enabled && !row.loaded && row.decryptable ? (
+
+ Failed to build: it is checking nothing. See the gateway log.
+
+ ) : null}
),
},
@@ -135,6 +155,13 @@ export function GuardrailsPage() {
)
},
},
+ {
+ id: "scope",
+ header: "Where",
+ cell: (row) => (
+ {scopeLabel(row)}
+ ),
+ },
{
id: "status",
header: "Status",
@@ -198,8 +225,9 @@ export function GuardrailsPage() {
}
>
Add checks that run on your LLM requests: prompt injection, personal
- data, harmful content and more. A request asks for a check by the name
- you give it here. Credentials are encrypted at rest.
+ data, harmful content and more. An enabled guardrail checks every
+ request from the workspaces you choose, without the caller asking for
+ it. Credentials are encrypted at rest.
@@ -273,7 +301,7 @@ export function GuardrailsPage() {
heading="Remove guardrail"
body={
pendingDelete
- ? `${pendingDelete} and the credentials stored with it are removed. A request that still names it as a profile is refused, so update the callers that use it.`
+ ? `${pendingDelete} and the credentials stored with it are removed, and the requests it was checking stop being checked. A request that still names it as a profile is refused, so update any callers that use it.`
: null
}
confirmLabel="Remove permanently"