Guardrails
How Telflo keeps AI interactions safe, private, and on topic.
Messages you send to the assistant, and the responses it returns, pass through guardrails. Guardrails block prompt injection and abuse, keep sensitive data out of requests and responses, and keep the assistant focused on OpenTelemetry and on Telflo itself. Which checks run depends on the mode. When a blocking guardrail is triggered, the assistant replies with a short safe message.
Input guardrails
Checked on what you send.
| Guardrail | What it catches | Modes |
|---|---|---|
| Prompt injection | Jailbreak attempts, role overrides, and attempts to extract or override the assistant's instructions. Blocks the request. | Plan, Build, Ask |
| Malicious intent | Requests aimed at data exfiltration, credential exposure, network attacks, resource exhaustion, or disabling security features such as TLS verification. Blocks the request. Requests to redact sensitive data, or to test that it is redacted, are not flagged. | Plan, Build |
| PII | Personal information in a prompt. Logged for review; it does not block the request and shows no message. | Ask |
The configuration in the editor is checked too. Whenever the assistant reads the current YAML, the YAML passes through the prompt-injection check first, shown as Running safety checks… in the chat. If it is flagged, the assistant does not read it and asks you to review the configuration. This matters for imported or shared configurations.
Output guardrails
Checked on what the assistant returns.
| Guardrail | What it catches | Modes |
|---|---|---|
| YAML safety | Unknown external endpoints, hardcoded secrets, or TLS verification turned off for an external endpoint in YAML that appears in the assistant's reply. Environment-variable references such as ${env:NAME} are not flagged. The configuration the assistant applies to the editor is delivered separately and is not covered by this check; review it in the editor. | Build |
| PII and secrets | API keys, credentials, or personal data in a response. | Build, Ask |
| Relevance | Off-topic answers, keeping the assistant on OpenTelemetry and on Telflo itself. Questions about the product, its modes, and its editor are on topic. | Ask |
Plan mode has no output guardrails, because it produces a plan rather than configuration.
What you see
When a blocking guardrail is triggered, the assistant replies with a short safe message. For a blocked prompt, the safe message is the only reply, and it asks you to rephrase around your OpenTelemetry needs. For a blocked response, anything the assistant had already streamed is removed from the chat and the safe message takes its place; it asks a follow-up question about your use case, or asks you to repeat the question, and does not retry on its own, so reply with the detail it asked for to get a new answer. A blocked message is not charged against your token balance, with one exception: a build started from the plan card's Build it is charged for the tokens it used even if a guardrail blocks it.
Keep secrets out of prompts
Avoid pasting real keys or endpoints into the chat. Reference credentials as environment variables with ${env:NAME} in the configuration, so they stay out of prompts and out of the YAML; when you install collectors from a deploy group on OpenTelemetry Collector Contrib, the install dialog lets you supply the values or leave them to be set on the host. See Install collectors. For shared non-secret values such as endpoints, reference an organization variable with $orgvar:NAME; the token stays in the YAML and is resolved when each collector checks in. The assistant preserves these tokens when it edits or validates a configuration, and if a token refers to an undefined organization variable it asks you to define it instead of inserting a value. See Organization variables.
Last updated on