A Chat control is a guardrail that checks the live agent as it answers — the user's input, the agent's output, or its tool use — and blocks or flags on a hit.
What a Chat control reads
A Chat control's Inputs can include User input, Agent output, Tool name, Tool input, or Tool output — so you can check what the user asks, what the agent replies, which tool it calls, or what its tools send and receive. Pick the inputs that matter for the rule; for example, a PII check on Agent output catches secrets in replies before the user sees them.
Prebuilt checks
| Check | What it catches |
| PII detection | Personally identifiable information. |
| Prompt Injection | Attempts to hijack the agent's instructions. |
| Credentials & Secrets | API keys, passwords, and similar secrets. |
| Content Filter | Categories such as Hate, Violence, Sexual content, Self-harm, Harassment, Criminal misconduct, and Profanity, each graded Off/Low/Medium/High. |
| Denied Topics | Topics you list by name, description, and example phrases. |
| Blocked Tools | Tool names matched with Contains / Doesn't contain and Match any / Match all. Blocked Tools reads Tool name. |
| Regex pattern | Custom pattern matches. |
| Custom terms | Specific terms you define. |
Or write a Custom check and have a model judge the conversation against a prompt you write, with a Binary or Scale output.
What happens on a hit
A Chat control's Action decides the outcome: Block stops the request or response from proceeding, and Flag allows it through but logs an incident for review. Some checks (for example PII detection, Credentials & Secrets, and Regex pattern) also offer Mask, which replaces the matched text with a mask token and lets the turn continue. Every action, hard or soft, creates an incident you can review under Governance › Incidents › Chat.
Severity and testing
Turn on Check severity to label hits as they occur, either graded by the model or at a fixed level, so incidents can be prioritized. New controls are Enabled by default. Use Test this control to enter sample user input, agent output, or tool data and confirm it fires the way you expect before you save, or switch Enabled off in the editor header until you've tested it. This avoids blocking real conversations by mistake.