Skip to navigation
Agentic Reasoning Engine

Guardrails

View as Markdown

The Moveworks AI Assistant handles a wide range of requests in a natural, conversational way. Guardrails keep those responses safe, work-appropriate, and grounded in your organization’s content. Some guardrails check what comes in, some shape how the engine reasons, and some check what goes out.

This page explains each layer. The pages in this group cover the parts you can configure or read about in depth:

Guiding principles

The Assistant follows these principles when it serves a request:

  1. Keep toxic, inappropriate, or offensive content out of the system.
  2. Be careful with sensitive and highly subjective topics.
  3. Answer with relevant content from the organization’s own resources.
  4. Focus on work-related requests.
  5. Use the available tools to serve a request. Don’t answer without trying a tool first.
  6. Show users the content each response was built from.

Input guardrails

Every message passes through these layers, in this order, before the Assistant answers.

Toxicity filter

Purpose: Keep harmful or non-work-appropriate requests out of the system.

How it works: The reasoning engine judges each request in the full context of the conversation, so it understands what the user is actually asking before deciding whether to help. Requests in the blocked categories (violent, non-violent illegal acts, sexual content, unethical acts, politically sensitive misinformation, and jailbreak attempts) get a short, consistent refusal such as “I’m sorry, but I can’t help with that.” The Assistant doesn’t discuss the request further.

Because intent is judged in context, a request that only touches a sensitive subject, like reporting harassment or finding mental-health support resources, is answered normally.

You can add your own topics to decline, or approved exceptions, in plain language. Jailbreak protection always applies and can’t be relaxed. See Configure Moveworks Toxicity Filter.

Sensitive topics policy

Purpose: Set the expectation that the Assistant isn’t the right place to discuss topics that are sensitive or highly subjective from one person to the next.

How it works: A policy applied to every request tells the engine’s model to look at the theme of the request and decline to discuss potentially sensitive matters, such as medical, psychological, physiological, emotional, financial, or political topics. This is separate from the toxicity filter. Here the user gets an acknowledgement and a polite refusal rather than a flat block.

Product and user context

Purpose: Have the engine read each request as a helpful, knowledgeable enterprise assistant would.

How it works: The engine’s prompt includes:

  1. The Assistant’s role and persona as a helpful enterprise assistant.
  2. An instruction to always use the provided tools to resolve requests, and not to respond without trying one.
  3. Information about the user, including name, location, and preferred language. See Personalization.
  4. The current date and time.

Organization-specific grounding

Purpose: Tell the engine which tools and knowledge are available. This varies by organization and can vary by user.

How it works: Using retrieval-augmented generation, the engine receives the tools that are available and relevant to the request:

  1. The relevant tools in the organization’s setup, including custom tools built in Tool Studio.
  2. Each tool’s description, arguments, and outputs.
  3. Instructions on how to use those tools, and when to point the user to help outside the Assistant.

Grounding the response in the organization’s knowledge and resources is enforced the same way. See Tool Selection for how the engine picks among them.

Purpose: Keep the Assistant working as an enterprise assistant, with relevant, work-appropriate content.

How it works: If a request is clearly not about work, the Assistant tells the user it can’t help with that and that it’s built for work-related questions.

Optional configurable instructions

Purpose: Guide how the Assistant responds in organization-specific situations.

How it works: Moveworks can append instructions to the prompt sent to the LLM. They influence behavior, for example during tool selection, but they aren’t deterministic overrides and they stay within the overall policies. For example, if both the Forms tool and the Knowledge tool get picked at different times for requests about moving an office and equipment, an instruction can steer the engine toward Forms. See Steerability Tools for the options available.

Output guardrails

The engine’s output is checked before it reaches the user.

Toxicity filter

The generated response is checked for work-appropriateness, just like the input. This second check protects against attempts to get around the input checks.

Citations

Purpose: Let users read the sources behind a response and check it for themselves.

How it works: The Assistant summarizes in chat and marks each source with a superscript number, for example (1). A citation can be a knowledge article snippet, a person’s profile card, an office map, or a response from a Tool Studio tool. Users open the citations from the info icon at the bottom of each response.

Linked verified entities

Purpose: Check the summarized response against the sources it came from, so users can trust specific details like names and links.

How it works:

  1. Moveworks defines the types of entity mentions to verify, such as people and URLs.
  2. Each of those mentions in the response is checked against the tool responses the engine used. If the mention is found in a source, it’s verified.

A verified entity has a small ”+” superscript. Clicking the ”+” takes the user to the reference where it was found.

FAQ

A response can include three kinds of links:

  1. Links from a knowledge article. Links inside the article are carried into the summary.
  2. Software deep links. For software set up for self-service, the Assistant can link to the organization’s internal software center, such as Microsoft Intune.
  3. Links from FAQs. A link in an FAQ, such as a password reset link, shows as a blue link in the response.

The response doesn’t link to the knowledge article itself. The LLM doesn’t have that link. Users can open the original article from the citations page.

The Assistant is built on generative AI, so link handling varies now and then. It can’t be fully eliminated, and Moveworks keeps tuning the prompt for consistency.

  1. Badly formatted link. Open the citations page and use the link from the source article.
  2. Missing link. Ask a follow-up such as “Can you give me the link?”
  3. Made-up link. Look for the ”+” from linked verified entities. A link without it wasn’t found in a source.

For more on how the engine works, see the Agentic Reasoning Engine overview.