Resources · n8n integration

n8n Guardrails nodeConfigure Guardrails in n8n.

Guardrails puts a filter between people and your AI steps. The n8n Guardrails node ships with 2 operations, one Chat Model port and a list of 9 guardrails, from personal data to jailbreak attempts. Useful when a workflow reads text you did not write yourself.

Try the Guardrails node on n8nSee the 2 operations

Verified Trustpilot reviews · AI, automation & growth agency

Why automate

What does the n8n Guardrails node actually do?

The Guardrails node is a checkpoint you drop around an AI step. It reads one piece of text, runs it through the guardrails you switched on, and then either sends the item down the Fail branch or hands back a redacted version of the same text. The check happens inside the workflow, on the item that just came through, and you decide what happens next.

First scenario: a support assistant that answers questions from a public form. Before the text reaches the AI Agent, the node runs Check Text for Violations with Jailbreak and Topical Alignment switched on. A message trying to talk the model out of its instructions leaves through the Fail branch, and the assistant never sees it. Both of those guardrails are LLM-based, so they need a chat model, that is a sub-node that talks to a model provider, plugged into the Model input.

Second scenario: an inbox that feeds a spreadsheet. Text pulled from Gmail goes through Sanitize Text with Personal Data (PII) and Secret Keys on, and what lands in Google Sheets has phone numbers, card numbers and stray API keys replaced by placeholders. The rest of the row stays readable, which is the whole point of redacting rather than blocking.

Third scenario: the other direction. A draft written by a model from OpenAI goes back through the node before anything is sent. With URLs on, every link that is not listed in Block All URLs Except counts as a violation, and Block userinfo stops links that carry credentials in them.

When to reach for something else: the Keywords and Custom Regex guardrails are pattern matching, not model work. If a blocklist of words or one regular expression covers your case, that path costs nothing at the provider. The model-based guardrails, Jailbreak, NSFW, Topical Alignment and Custom, are the ones that need the Chat Model connection, and the provider bills those calls under its own terms.

The limits worth knowing before you build. The node works on text, one string at a time, taken from the Text To Check field. Sanitize Text offers a subset of the guardrails, the ones that detect URLs, regular expressions, secret keys and personal data. Thresholds sit between 0.0 and 1.0, so a guardrail is a confidence call, not a yes or no oracle, and it is worth testing your own samples before trusting a value. This page describes version 2 of the node; an older workflow may show fewer options. If you want an outside read on the platform itself, there is our n8n review.

Connections

What do you plug into the node?

Guardrails is a root node: it sits in the main flow, and a sub-node hangs off its port to do the model work. You draw the connection on the canvas, so the sub-node never shows up in the parameter panel.

Ports (what plugs in)

  • Chat Modelai_languageModelrequired
01Chat ModelThis port carries the model that evaluates the LLM-based guardrails: Jailbreak, NSFW, Topical Alignment and Custom. Without it, those checks have nothing to reason with.

This port carries the model that evaluates the LLM-based guardrails: Jailbreak, NSFW, Topical Alignment and Custom. Without it, those checks have nothing to reason with.

Key parameters

  • Required: the Check Text for Violations operation needs a chat model connected here as soon as one of the LLM-based guardrails is on.
  • OpenAI Chat Model or Anthropic Chat Model: the usual starting point when the provider already holds your credential.
  • Ollama Chat Model: the option when the text should not leave your own machines.
  • Google Gemini Chat Model: another hosted option, wired the same way.
Use cases
a public chat form where the jailbreak check runs on every message before the answer is drafted.
Actions

What can the node do with your text?

The Guardrails node exposes 2 operations. For each one: the node as you configure it in n8n, the required fields, and our field notes.

01

Check text for violations

classify

What you see in n8n

Notes & use cases

Runs the full set of guardrails over one string and sorts the item: clean items continue, anything flagged leaves through the Fail branch.

Key parameters

  • Text To Check: the string under inspection, usually mapped from an earlier node with an expression such as {{ $json.message }}.
  • Jailbreak: catches attempts to bypass the model's safety measures, with a Threshold between 0.0 and 1.0 where a higher value is stricter.
  • Topical Alignment: a Prompt describes the allowed scope, and anything off-topic is flagged.
  • Keywords: a comma-separated blocklist, matched without any model call.
Use cases
screening every question from a public form before an agent answers it.
02

Sanitize text

sanitize

What you see in n8n

Notes & use cases

Keeps the item moving and rewrites the risky parts instead of blocking them: detected values are swapped for placeholders, so the text stays usable downstream.

Key parameters

  • Text To Check: the string to redact, often the body of a message picked up earlier in the run.
  • Personal Data (PII): Type set to All scans every entity, or Selected lets you pick from a list such as CREDIT_CARD, EMAIL_ADDRESS and PHONE_NUMBER.
  • Secret Keys: Permissiveness chooses how eager the scan is, Strict, Balanced or Permissive.
  • Custom Regex: the Name you give a pattern becomes the placeholder written in its place.
Use cases
cleaning support emails before they are archived in a shared sheet.
Need help

Need help automating Guardrails with n8n?

A person reads every message.

FAQ

Questions people ask about Guardrails in n8n

01Is the Guardrails node included in n8n, on Cloud and self-hosted?
Yes. Guardrails belongs to the AI package that ships with n8n, so there is nothing to install and nothing extra to pay on the n8n side, on n8n Cloud or on a self-hosted instance. The same workflow behaves the same way in both. The one cost that can appear is not an n8n cost: the LLM-based guardrails send a request to whichever model provider you connect on the Chat Model port, and that provider bills its own API calls under its own terms. Guardrails that rely on keywords or a regular expression do not call a model at all, so they carry no provider cost.
02What do you need to set up before the n8n Guardrails node runs?
Nothing on the account side. The node has no credential and no Authentication selector, so there is no key to paste and no app to authorize before the first run. What it does need depends on the guardrails you switch on. Keywords and Custom Regex work on their own. Jailbreak, NSFW, Topical Alignment and Custom are model-based, so they need a chat model sub-node connected to the Model input, and that sub-node is the one carrying the provider credential. Plug in the model once and every LLM-based guardrail in the node uses it.
03What are the limits of the Guardrails node?
It works on text, one string at a time, taken from the Text To Check field, so anything you want checked has to be mapped there first. Sanitize Text does not offer the whole list: it covers the guardrails that detect URLs, regular expressions, secret keys and personal data, and it replaces what it finds with placeholders rather than stopping the item. The model-based checks return a confidence score compared against a Threshold between 0.0 and 1.0, which means borderline text can pass or fail depending on where you set that value. This page covers version 2 of the node.
04What do you have to connect at minimum, and which sub-node is easiest to start with?
At minimum, one chat model on the Model input, as soon as a model-based guardrail is on. A sub-node is a small node that does not run on its own: it only works while the node it is attached to is running. OpenAI Chat Model and Anthropic Chat Model are the simplest starting points if you already hold a credential with either provider. Google Gemini Chat Model works the same way. If the text should never leave your own infrastructure, Ollama Chat Model keeps the evaluation local. Start with one guardrail, check the results on your own samples, then add the others.
05n8n or Make for adding guardrails to an AI workflow?
It comes down to hosting and cost shape. Make runs only on its own hosted platform and charges by operation, which is predictable and needs no server on your side. n8n runs on n8n Cloud or on your own machines, so a text check on sensitive content can stay inside your network, and with a local model on the Chat Model port nothing leaves it at all. Both build workflows visually. If you already run n8n, Guardrails is one node in the same canvas as the rest of your automation, which keeps the safety check next to the step it protects.
Hack'celeration Lab

Get our weekly integration tips.

No spam. Unsubscribe anytime.

Same platform

Other docs you might need on this stack.

Browse all integrations