NeMo Guardrails

A specialized modeling language for defining conversational flows and constraints. Developers write .co files to specify canonical forms of user messages, bot utterances, and flows that orchestrate multi-step interactions. Colang allows you to define:

• User canonical forms: Patterns like user "ask about pricing"
• Bot definitions: Responses the bot should give
• Flows: Sequences that guide the conversation, including branching logic and slot-filling. This declarative approach separates guardrail logic from application code, making safety rules auditable and maintainable.

Constraints that keep conversations within approved domains. Topical rails prevent the bot from engaging with out-of-scope requests by routing them to a predefined fallback response. Key capabilities include:

• Jailbreak prevention: Detecting and blocking attempts to override system instructions
• Topic boundary enforcement: Defining exactly which subjects the bot can and cannot discuss
• Sensitive data filtering: Masking or redacting PII, API keys, and credentials before they reach the LLM These rails operate as a pre-processing firewall, intercepting user input before it reaches the model.

Rules that enforce ethical and compliance boundaries. Safety rails scan both user input and bot output for toxic language, hate speech, and self-harm content using configurable detection models. The system supports:

• Input self-check: Blocking harmful prompts before processing
• Output self-check: Validating generated responses before delivery
• Custom sensitive topics: Defining organization-specific prohibited subjects
• Multi-stage validation: Applying multiple independent checks in sequence When a violation is detected, the rail can either block the response entirely or rewrite it to a safe alternative.

Verification constraints that ground LLM outputs in factual data. Fact-checking rails integrate with Retrieval-Augmented Generation (RAG) pipelines to validate claims against trusted knowledge bases. The architecture supports:

• Hallucination detection: Comparing generated statements against retrieved documents
• Alignment scoring: Using NLI models to measure entailment between source and output
• Automatic correction: Rewriting unsupported claims or appending disclaimers
• Streaming validation: Checking facts in real-time during token generation This creates a verification loop where the bot's output is continuously audited against ground-truth data.

Constraints that enforce proper conversational flow and prevent the bot from going off-script. Dialog rails define:

• Multi-turn sequences: Required steps like collecting user information before proceeding
• Slot-filling logic: Ensuring all necessary parameters are gathered
• Fallback handling: Graceful responses when the bot doesn't understand
• Context persistence: Maintaining state across conversation turns These rails ensure the bot follows deterministic interaction patterns even when the underlying LLM generates unpredictable responses, creating a predictable user experience.

A server-side component that executes custom actions triggered by guardrail rules. The action server enables:

• API calls: Fetching real-time data to verify claims
• Database queries: Checking facts against internal systems
• External model invocation: Calling specialized classifiers for content moderation
• Custom business logic: Implementing organization-specific validation rules Actions are defined in Python and invoked from Colang flows, creating a bridge between conversational logic and backend systems. This decoupled architecture allows guardrails to interact with any enterprise infrastructure.

A metric evaluating whether all factual claims in a generated text are supported by a source document. It measures the alignment between output and grounding context.

• Core metric for summarization and RAG evaluation
• Often computed using Natural Language Inference (NLI) models
• A score of 1.0 indicates perfect entailment from source
• Distinct from fluency or relevance metrics

A metric evaluating whether a model can correctly link a generated claim to the specific segment of a source document that supports it. Measured by Citation Recall and Citation Precision.

• Citation Recall: Proportion of claims with supporting citations
• Citation Precision: Proportion of citations that actually support the claim
• Critical for enterprise RAG deployments
• Enables auditable AI outputs

The reducible uncertainty in a model's prediction caused by a lack of knowledge or training data. Unlike aleatoric uncertainty, this can be decreased by collecting more data or refining the model architecture.

• High epistemic uncertainty signals out-of-distribution inputs
• Quantified via Deep Ensemble variance
• Triggers guardrail interventions when thresholds are exceeded
• Key input for risk-based routing decisions