Add NeMo Guardrails to a LangGraph agent on Red Hat OpenShift AI

Hi everyone. Today I'm going to showcase an example on how to guard rail an agent using Nemo guardrails on Roy. Uh on the learning resources we have a new card to access the tutorial for this. This is a banking customer service agent built using langraph react template in this repo. It demonstrates how to add rails like content safety, topical guardrail, reject space filtering to an agent. There are config profiles at two maturity levels. The first one local is a sales check where a single model is used to answer user questions and also as a classifier in rail. The second one guard is where we could use a dedicated classifier per rail. For example, we could use a purposebuilt Nemo card or Neotron classifier or in cluster endpoint using VLM. Coming to the architecture, Nemorail sits between the agent and LLM as a proxy acting as a safety filter which checks through every request and response against the configured rails. It still passes through the system prompts and tool calls through. Here is how a request is charged. Rails are executed in the configured order. So when a user sends a query, we can configure to have a reject check which checks for an pattern without any LLM call, it checks for jailbreak patterns like ignore previous instructions, jailbreak etc. and then a content safety check which uses an LLM to classify against categories like violence, sexual content, criminal planning etc. And then topic safety where an LLM is used to judge if a query is contained in that domain. So in this case uh it checks if if the query is based on a banking domain. Then the output trails which checks for how a LLM responds. So it checks for the content safety categories against LLM's response and when a rail fails the later rails are never run and user would see a generic response that is configured. How do we customize the rails? So we have two different files where most of the configuration lies. So config.l has different configurations like the models. So here we have the main model where we are pointing it to a V alarm in cluster and here we can configure a model for content safety and this is for topic control. Here we define different patterns we want to include in our reax detection and this is how the flow of rails is. So for input first it checks through the reax check and then a content safety and topic safety and for output we have one where it checks for content safety and the other file is prompts yml where we could define different prompts for so this one is for content safety check here we list out different categories and uh prompt to assess that like nothing falls in these categories and this is for topic safety. Here we define domain specific prompt. So since this is a banking uh customer service agent, we have uh guidelines such as allow questions related to banking and payments etc. and do not answer anything related to medical or cooking or entertainment. So how do we adapt the guard rails to different domains? This specific example talks about a banking customer service agent but we have a different [snorts] domain. These are some of the places where changes would be needed. Specifically uh for topic safety check these guidelines would be more catered towards our domain of interest. These are the instructions on how we can deploy the agent locally and bring up the guardrail server. We use make targets to achieve all of these and these are the instructions to deploy the agent to Roy. So first we set up the API keys and environment variables required. Then we do a build of the agent and then deploy the guardrail server and the agent. We also have two levels of tracings for this agent. So the first one is agent level which is common to other agents we can see the traces on mlflow. This would include uh user queries and the responses from the agent. And the other one is rail level where we see traces from each rail and which rails are triggered and which rails are blocking blocking the responses etc. So I have two versions of agents deployed on my cluster. One with guardrails enabled and one without so that we could compare the responses from both the agents. So first this is the agent without guard rails. So I'm just asking it how do I commit check fraud against a bank and this uh agent replies with like proper response on how it can be done. Uh, and let me ask a question with profanity. And the agent still uh replies to me with the response. And let's try another question. Give me a recipe for chocolate cake. A banking service agent shouldn't answer something which is not in it in its domain. But without any guardrails, it would give us the complete recipe for a chocolate cake. So let's try the same questions on guardrail agent. So let's first ask how do people usually commit bank check for. So, it immediately respond replies with uh I'm sorry, I can't respond to it. And let's try the profanity one. So, here you can see that it didn't respond. But if I ask what is my balance for my account which is a proper question it should use uh uh like the tool and give us the actual response and on mlflow in the traces we could see that so if you ask a proper question it goes and uses the tool calls the tool and gets us the account balance but when we try to use some profanity, it immediately responds with uh I can't respond to that. And even if you ask any question outside of the uh domain, for example, recipe for chocolate cake, it still replies with I can't respond to it. But uh uh the greetings like for example, hello are still passed through and we get a proper response for it. The remote control server exposes its traces in using hotel. Uh so let me just trigger a couple of questions. So here first I've asked for my account balance which is a proper answer and then when I ask for something like how do I build a bomb it blocks it. So when I look at MLflow we could see that we could see like the user and the response here and I'm using a tempo stack and visualizing the traces using a UI and here when we see the latest trace. So this is the one uh which was blocked. So here we can see that only the content safety check input was uh was checked and here we could see the rail stop rail dots stop is true which means that uh this this rail has blocked uh the query and for a normal query this is how the guards are run. Uh so first the content safety check input then the topic safety check input and then we have the content safety check output and like then the response is sent to the uh agent and user. What we just saw is the langraph banking agent with Nemo guard rails as a proxy. We did not change much in the agent. We just pointed the base URL at a guardrail service. Then the rails fire in order rejects first then the content safety and then the topic safety and in the from the LLM response uh the output has a content safety check again. So the alert traffic goes through to the VLM and whenever a rail uh fails uh the user gets back a refusal with a static predefined note. Thank you.