UiPath Agent Guardrails and AI Trust Layer Security for UiPath Agents and Tool Calls
UiPath agents now read invoices, update vendor records and trigger robots across the systems your automations already touch. UiPath gives them three guardrail scopes (agent, LLM and tool), deterministic rules on tool inputs and outputs, escalation to a person, and since October 2026 the option to bring your own safety vendor. This page shows what each control stops, what it only logs, and the few cases where a second control outside UiPath is worth paying for.
Direct answer
UiPath agent guardrails are checks that run at three points: on the agent prompt, on each LLM call, and on each tool call. Each one can log, block or escalate to a person, and custom tool guardrails add deterministic rules on input and output fields, including filtering fields out. For agents built and run inside UiPath, those controls are the right first layer and often the only one you need. A second control earns its place when the same tools are also called by agents outside UiPath, such as Claude Code or Codex acting through the uip CLI.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A US logistics company runs a UiPath agent that reads carrier invoices and calls an API workflow to update remit-to bank details in its ERP. A developer added a PII guardrail and a prompt injection guardrail with the Log action while tuning thresholds, and nobody switched them to Block. An invoice arrives with instructions hidden in a footer. The guardrail fires, writes a warning to the trace, and the agent changes the bank account anyway, because the configured action was to record the event, not to stop it.
How AgentShield handles it
Use UiPath first. Turn on the out-of-the-box guardrails at the organization level in the AI Trust Layer policy, set Block for agents that touch payments, vendor data or access, and add custom tool guardrails with rules on the fields that matter, such as amount, payee and destination, with Escalate for anything a person should see. Put AgentShield behind the API and MCP endpoints that UiPath agents share with agents on other platforms, and in front of coding agents that act on your UiPath tenant. There, one policy checks every call by tool and argument, holds risky ones for a named approver who is not the requester, and records the decision outside the tenant.
The controls
The controls that secure which UiPath agent tool calls run, which ones escalate to a person, and what happens when a guardrail cannot run.
What UiPath agent guardrails cover and when each one acts
UiPath splits agent guardrails into managed checks and custom tool rules. The managed checks run on UiPath-hosted safety services. Administrators can set them once for the whole organization in the AI Trust Layer policy in Automation Ops, and developers can add more per agent in Studio Web. Each check applies to one or more scopes: the agent's own prompt and output, the requests and responses exchanged with the model, or a tool's inputs and outputs.
| Guardrail | Service behind it | Where it can run | Actions |
|---|---|---|---|
| PII detection | Azure Cognitive Services | Agent, LLM calls, tools | Log, block, escalate |
| Prompt injection | Noma Security, hosted in the United States | LLM requests and responses | Log, block, escalate |
| User prompt attacks | Azure AI Content Safety | Before the model call only | Log, block, escalate |
| Harmful content and IP protection | Azure AI Content Safety | Harmful content on all three scopes, IP protection after the model call only | Log, block, escalate |
| LLM as Judge | A judge model you choose | Agent, LLM calls, tools | Log, block, skip |
Read the last column carefully. Log is a valid choice while you tune thresholds, and UiPath recommends Block for agents that handle sensitive or business-critical data. The detectors also judge text. A polite, well-formed request to change a bank account contains no PII, no harmful content and often no recognizable attack pattern, which is why the tool scope matters more than the model scope for agents that write.
What UiPath shipped for agent security in 2026
If your last review of UiPath agents happened in 2025, most of this is new. Dates come from UiPath's release notes and newsroom.
| Date | What UiPath released | Why it matters for security |
|---|---|---|
| May 5, 2026 | Agentic capabilities in self-hosted Automation Suite for government and regulated industries, with cloud or self-hosted models | Agents can now run on premises, so the guardrail and audit design has to work without UiPath's cloud services |
| May 12, 2026 | UiPath for Coding Agents, starting with Claude Code and OpenAI Codex | Outside agents can now build and operate automations in your tenant through the uip CLI |
| May 2026 | Harmful content, IP protection and user prompt attack guardrails in public preview | More managed checks, all of them on text |
| October 1, 2026 | Bring your own guardrail subscription in preview for Azure AI Language, Azure Content Safety and Noma, with an optional fallback to UiPath-managed guardrails | Your own safety vendor can evaluate agent traffic, and you decide what happens when it is unreachable |
| October 7, 2026 | A governance policy that lets users get AI and agentic usage top-ups automatically | Spending approval for agent usage can now be removed by policy, so check who owns that setting |
None of this is cosmetic. Two of the five entries widen what an agent can do in your tenant, and two change how a guardrail behaves when something goes wrong.
Custom tool guardrails are deterministic, and they are the control to set up first
The strongest control UiPath gives you is not a detector. It is the custom guardrail builder on each tool. UiPath describes it as a way to "control unexpected behaviors within tool calls deterministically." A tool can carry several guardrails. Each guardrail holds one or more rules and one action, rules are evaluated against the tool's inputs and outputs, and the action fires only when all rules are met. Guardrails are checked from top to bottom in the order they are listed.
Rules work on string, number and boolean fields, including nested JSON fields. Actions are Log, Filter (remove selected fields from what goes to the tool or comes back to the agent), Block and Escalate. That is enough to write the rules most finance and operations teams actually need.
| Tool | Rule | Action | Why |
|---|---|---|---|
| Update vendor bank details | Always enforce, before execution | Escalate to the AP supervisor group | Every change of remit-to details gets a second person |
| Create payment request | Amount above your approval limit | Escalate | Large agent-proposed payments wait for a human |
| Send document by email | Recipient address does not end with your company domain | Block with a reason | Stops quiet export of files to outside addresses |
| Look up customer record | Always enforce, after execution | Filter the SSN and date of birth fields | The agent never sees fields it does not need |
Two design notes. Because all rules in one guardrail must match, an "either this or that" condition needs two guardrails on the same tool. And every rule lives on one tool inside one agent, so ten agents that call the same payment API need the same rules written ten times and kept in step. Our tool permissions page shows the same idea written once as a central policy.
Three behaviors to check before you rely on UiPath guardrails
These come straight from UiPath's documentation. None of them is a defect, and each one is a decision your team should make on purpose rather than discover in an incident review.
| Behavior | What UiPath's docs say | What to decide |
|---|---|---|
| Guardrails depend on license entitlements | If entitlements are disabled after guardrails are configured, agents "will simply skip those guardrails during execution" and runs do not fail | Monitor entitlement changes, and do not let a license renewal silently remove your blocking checks |
| Bring your own provider can fail | With fallback on, evaluation moves to the UiPath-managed guardrail. With it off, "the evaluation fails and the agent step is blocked" | Fail closed for agents that move money or grant access, fail over for low-risk agents |
| Escalation needs a deployed app | Escalate requires the Agent Tool Guardrail Escalation App, deployed in a shared folder with serverless robots, and its action schema must not be changed | Test an escalation end to end before go-live, including who receives it on nights and weekends |
The first row deserves the most attention. It is a sensible design for availability, because a license lapse should not break production. It also means a control you configured can stop applying without any change to the agent. If an agent's safety depends on a Block action, record that dependency where your license administrator will see it.
Coding agents and outside agents acting on your UiPath tenant
UiPath for Coding Agents lets Claude Code and OpenAI Codex build and operate automations. UiPath's governance page is direct about the trust model: "A coding agent has no UiPath access of its own." Everything goes through the uip CLI, which is signed in as exactly one UiPath identity. UiPath adds that no separate setting grants an agent less access than the identity it runs as, and that it "records the identity the CLI signed in as, and nothing beyond it."
| Question | What UiPath controls | What you still own |
|---|---|---|
| Which identity does the agent act as? | Roles, folders and tenant assignment of that identity | Creating a dedicated, narrow identity per person or workload instead of a developer's own account |
| Where does the credential come from? | A fixed resolution order across Robot session, environment token, saved login and local Robot | Pinning a named profile so the CLI cannot fall through to a broader identity |
| What may the coding agent do before it touches UiPath? | Nothing. UiPath recommends guardrails on the third-party coding agent itself | Rules on the commands, APIs and MCP tools the coding agent can call |
| Who did what? | The signed-in identity is recorded | Mapping a shared identity back to a person, and keeping evidence outside the tenant |
That third row is where UiPath hands the problem back, in writing. If your developers run Claude Code or Codex against production tenants, the guardrail belongs on the coding agent's side. We cover those two agents on our Claude agent security and Codex security pages.
UiPath agent pricing and what guardrails add to the bill
Production agent runs consume Platform Units on Unified Pricing or Agent Units on Flex. On UiPath-hosted models a standard model costs 0.2 Platform Units or 1 Agent Unit per LLM call, premium models cost double, and basic models cost 0.8 of the standard rate. The managed guardrails are included on the eligible plans (Flex Enterprise Standard and Advanced, and Unified Standard, Enterprise and the App Test plans). The exception is LLM as Judge, which makes its own model call and is billed separately at the same per-model rates on top of the agent's consumption.
So the guardrail decision has a cost shape. Deterministic tool rules cost nothing extra. Judge-based checks scale with every call. We break down the unit math and the security lines that sit outside UiPath's SKU in our UiPath agent pricing and Agent Units guide.
UiPath agent security checklist for US automation teams
- Set organization-wide guardrails. Configure the managed checks in the AI Trust Layer policy so a new agent starts protected, then add per-agent checks on top.
- Move from Log to Block on purpose. Keep a dated list of agents still on Log while thresholds are tuned, and close it.
- List the write tools. For each agent, list the tools that change records, move money, send data out or grant access.
- Put custom rules on those tools. Rules on amount, payee, destination and record type, with Escalate for anything a person should see and Filter for fields the agent does not need.
- Test the escalation path. Deploy the escalation app, confirm serverless robots exist in the folder, and run one real escalation before go-live.
- Decide fail-open or fail-closed. Set the bring-your-own fallback per risk level, and watch entitlement changes that would make agents skip guardrails.
- Give coding agents narrow identities. One dedicated identity per person or workload, a pinned CLI profile, and rules on the coding agent before it reaches the tenant.
- Keep evidence outside the tenant. Who approved which call, with which values, retained on your schedule for SOX and internal audit.
When to buy nothing, use UiPath guardrails, or add AgentShield
| Your situation | Recommendation | Why |
|---|---|---|
| Agents only read and summarize documents | Buy nothing. Turn on PII and prompt injection checks | There is no write action to gate |
| Agents built in UiPath call tools that only UiPath agents use | Use custom tool guardrails with Block and Escalate | Deterministic rules on the tool are exactly what you need, and they cost nothing extra |
| You need an inventory of agents and owners | Start with Orchestrator, Automation Ops and your identity directory | Inventory comes before policy |
| You already pay for Noma or Azure Content Safety | Bring that subscription into the AI Trust Layer | One detector across UiPath and your other apps, and no new vendor |
| UiPath agents and agents on other platforms call the same payment, vendor or access APIs | Add AgentShield in front of those APIs and MCP servers | One rule set, one named approver flow and one audit trail instead of rules copied into every agent |
| Claude Code or Codex act on your UiPath tenant | Add AgentShield on the coding agent's tool calls | UiPath recommends guardrails on the third-party agent, which is outside UiPath |
Four of six rows end without a purchase from us. UiPath's prompt injection guardrail runs on Noma, and we keep an honest Noma Security comparison if you are weighing it directly. For how to choose which actions deserve a human at all, see our guide to human approval for AI agents. The same shared-tool pattern applies to SAP Joule security and ServiceNow AI agents security, which many UiPath customers run beside it.
FAQ
Common questions about uipath agent guardrails.
Does UiPath have guardrails for AI agents?
Yes. UiPath Agents support guardrails at three scopes: the agent prompt, each LLM call and each tool call. Managed guardrails cover PII, prompt injection, user prompt attacks, harmful content, IP protection and LLM as Judge, and custom tool guardrails add deterministic rules on input and output fields with Log, Filter, Block or Escalate actions.
What is the UiPath AI Trust Layer?
The AI Trust Layer is where UiPath administrators govern AI use across the organization. For agents it holds the organization-wide guardrail policy, bring-your-own model and guardrail configurations, and usage governance such as top-up policies. Settings made there apply to every agent in scope, while developers can add stricter guardrails per agent in Studio Web.
Can UiPath agents escalate to a human for approval?
Yes. Both managed and custom guardrails support an Escalate action that assigns the case to a user, a group or an external address through an action app. Custom tool guardrails need the Agent Tool Guardrail Escalation App from the UiPath Marketplace, deployed in a shared folder with serverless robots, and its action schema must not be changed.
Does UiPath protect agents against prompt injection?
Yes, with two managed checks. The prompt injection guardrail runs on Noma Security and monitors LLM requests and responses, and the user prompt attacks guardrail runs on Azure AI Content Safety before the model call. Both detect suspicious text. Pair them with tool rules, because an injected instruction can read like an ordinary business request.
What happens if UiPath guardrail entitlements are disabled?
UiPath documents that agents simply skip the affected guardrails during execution and runs do not fail. That keeps production running after a license change, but it also means a blocking control can stop applying with no change to the agent. Track which agents depend on Block actions and review them whenever entitlements change.
Can I bring my own guardrails into UiPath?
Yes, in preview since October 1, 2026. Administrators can connect an Azure AI Language, Azure Content Safety or Noma subscription in the AI Trust Layer, and those validators appear beside UiPath-managed guardrails with the same scopes and actions. A fallback setting decides whether a provider outage uses the UiPath-managed check or blocks the agent step.
How do Claude Code and Codex access UiPath?
Through the uip CLI, which signs in as exactly one UiPath identity. The coding agent has no UiPath access of its own and can reach only what that identity can reach, and UiPath records only that identity. UiPath recommends a dedicated, narrowly scoped identity and guardrails on the coding agent before it gets access.
Does AgentShield work with UiPath agents?
Yes, for the APIs and MCP servers that UiPath agents and other agents call. Point those calls at an AgentShield gateway endpoint that holds the real credential. Each call is checked against tool and argument policy, risky calls wait for a named approver who is not the requester, and every decision is logged outside the UiPath tenant.
More use cases