The Chat tab under Incidents logs every guardrail hit raised while your agent handled a live conversation — a check on the user's input, the agent's output, or a tool call that a Chat control caught.

What raises a Chat incident

A Chat incident is written whenever a Chat control fires during a conversation — the control watches the user's input, the agent's output, or tool input/output, and a hit on any of these creates a record here. Because Chat controls guard live LLM calls, responses, and tool use, incidents on this tab reflect real conversational turns, not indexed documents.

What the list shows

Filter by Status, Action, Policy, or a Detected date range to narrow the list.

Blocked vs. Flagged

Blocked means the control stopped the request or response from proceeding — the user or the agent didn't get through with that turn. Flagged means the turn was allowed through but logged here for review. Flagged Chat incidents are worth a closer look, since the conversation carried on despite the hit.

Masked and Redacted mean the matched text was hidden or removed, and the rest of the turn went through. Masked replaces the matched text with a mask token. Redacted strips it. You only see these outcomes for checks that support them.

Reviewing the conversation

Open an incident to see the conversation snippet where the hit occurred, plus a View trace link to the full execution — useful for understanding exactly what the user asked, what the agent was about to say or do, and why the control caught it. The Control violated section links back to the specific control and the policy it's part of, so you can jump straight to tuning either one.

Triaging a Chat incident

Set the Status, assign an owner, and add Notes, then click Save. Mark an incident False Positive when the control caught something that wasn't actually a violation — that's a signal the underlying control's check may be too broad for normal conversation.