Introduction
Some subjects an agent must simply not discuss — not because the words are forbidden, but because the subject is. Compensation. Pending litigation. An unannounced product.
A pattern cannot express that. Denied Topics can, because it works on meaning rather than text.
What it detects
"Named topics the agent must not discuss, detected by an LLM classifier."
You define topics; a classifier decides whether the content is about one. That means it catches a conversation about salary bands whether or not anyone used the word "salary".
Defining a topic
Each topic takes three things, and the third does most of the work.
The control's settings are a Classifier model (required); one or more topics, each with a Name and Description (required) and example phrases; and a Confidence threshold (default High). It runs on User input and Agent output.
Field | What it is for |
| What the topic is called. Appears on the incidents it raises. |
| What this topic covers. The classifier's definition of the boundary. |
| Phrases that fall under it. How the classifier learns where the boundary sits. |
The description and examples are the control. A topic named Compensation with no description is an invitation for the classifier to guess what you meant. The same topic described as "salaries, bonuses, equity grants, and individual pay decisions", with three or four example questions, behaves predictably.
"The topic name is for you. The description and the examples are for the classifier — and it only knows what you tell it."
One control can carry several topics, which is right when they share an action and a scope. Split them when you want to block one and flag another.
Where to run it
Applied on | Answers |
| Are people asking about this? |
| Is the agent discussing it? |
The two answer genuinely different questions. User input tells you about demand — useful intelligence even when the agent handled it correctly. Agent output tells you about exposure, which is what you are accountable for.
The shipped ISO 42001 pack runs its denied-topics control on User input and Agent output with a Flag action, and that control raises the overwhelming majority of the pack's incidents — a good indication of how broad a topic control can be if the definition is loose.
Actions
Classification answers yes-or-no rather than reporting a position, so Mask is not offered. Flag and Block are.
Blocking a topic stops the interaction with a fixed content-guidelines message rather than an explanation, which for an internal agent is usually acceptable and for a customer-facing one usually is not. Most teams flag on user input and block on agent output.
Tuning
Noise is almost always a loose description — Before touching anything else, reread the description as though you were the classifier. "Anything financial" will catch every invoice question you have.
Add examples from the false positives — The incidents that should not have fired tell you exactly where the boundary is wrong.
Split broad topics — Two narrow topics with clear descriptions behave better than one broad one, and their incidents are easier to judge.
Remember it costs per evaluation — This is an LLM-backed check. On a busy agent watching several points, that is a real line in governance spend.
Known limitations
No Mask — The check cannot say which span made the content about the topic.
Discussion and mention are hard to separate — Content explaining that a topic is off-limits can itself classify as being about it.
It costs a model call — Every evaluation, on every input the control reads.