docs(guardrails): document ByoValidator on the core guardrails page - #1854
Merged
Conversation
`ByoValidator` ships in `uipath.platform.guardrails` (exported at the top level, same as every other validator) but the core guardrails page never picked up a section for it, so the only rendered documentation of BYOG is the LangChain adapter page. Readers of the core page reasonably conclude Bring Your Own Guardrail is LangChain-only — it isn't; the validator is framework-agnostic and the LangChain package merely re-exports it. Add a `### Bring Your Own Guardrail (BYOG)` section alongside the other built-in validators, following the same shape as its siblings: what it does, the all-stages note, the admin prerequisite, a runnable example, and the two parameters. Also list `ByoValidator` in the execution-stages table under `PRE_AND_POST`. Verified against the source: import path, positional `validator_name`, keyword-only `parameters`, `validator_type == "byo"`, serialization to `byoValidatorName`, and the empty-name `ValueError` all behave as written. Docs only.
Contributor
There was a problem hiding this comment.
Pull request overview
Documents the framework-agnostic Bring Your Own Guardrail (BYOG) validator (ByoValidator) on the core guardrails documentation page so users can discover and use BYOG without needing the LangChain adapter docs.
Changes:
- Adds
ByoValidatorto thePRE_AND_POSTrow in the execution-stages support table. - Introduces a new “Bring Your Own Guardrail (BYOG)” section describing prerequisites, behavior, and parameters, with a runnable usage example.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
valentinabojan
approved these changes
Aug 12, 2026
1 task
apetraru-uipath
added a commit
to UiPath/skills
that referenced
this pull request
Aug 12, 2026
…-513] Bring-your-own guardrails (BYOG) let a tenant serve a validator from its own external provider — Azure AI Content Safety, Databricks, a custom connector — instead of UiPath's built-in implementation. An admin registers the configuration; agents then reference it by name. None of the agent-authoring side was documented. This covers it for both agent types, plus review and troubleshooting, and adds tests for the thread users actually hit: adding a BYOG guardrail to an agent they already have. Docs - lowcode/guardrails.md: BYO section — `Validator` is not unique once a BYOG configuration exists (a tenant sees two `pii_detection` entries, one built-in and one BYO, disambiguated by `IsByo`), the `--byo` filter, the extra `Byo*` fields, and how to pin a guardrail with `byoValidatorName`. - coded/guardrails.md: the section was previously a gate with the API left unresolved — it named no class and told the agent to stop and report BYO unavailable, which now reads as a false negative. It carries an availability table (`UiPathByoGuardrailMiddleware` is LangChain-adapter only; `ByoValidator` is a CORE class re-exported by the adapter, so BYO is not LangChain-only), worked examples for both styles with source-verified signatures, and the wire format both emit: `validatorType: "byo"` plus `byoValidatorName` — the same field low-code pins with, so the two halves converge. Critical Rule 18 rewritten; pointers added from the Middleware and Decorator style sections. - Both recommend files: key validator lookups on `(Validator, IsByo)`, not `Validator` alone, or a same-named built-in and BYO entry collide and correctness checks read the wrong entry's `Parameters`/`AllowedScopes`. Default recommendations to the built-in unless the user asks for BYO. - uipath-review (both guardrail files): the same disambiguation, plus `Status: Disabled` on a BYO entry is a tenant configuration switch, not a schema defect — don't re-diagnose it as one. - uipath-troubleshoot: BYOG as a cause of a guardrail violation, how to cross-check configuration health, and the resolution path for a disabled configuration or dead connection. Corrections found while writing the above - `byoConfigurationId` was never a real authoring field; `ByoValidatorName` is what both low-code and coded agents reference. Swept everywhere. - Dropped the last "the BYO construct carries a connection id" claim, which contradicted the same file, Rule 18, and the review skill. No connection id exists in either API — the platform resolves it server-side. - coded/guardrails.md claimed middleware never accepts `stage=`. Source shows five do (PII, harmful content, LLM-as-judge, deterministic, BYO); only the three fixed-stage validators don't. Pre-existing bug, corrected in place. Tests — adding BYOG to an existing agent Three tasks, all editing a pre-built fixture with no scaffolding graded, so the score reflects only the BYOG wiring: - lowcode byog_pinning: pins `byoValidatorName` in the shared WebResearchBriefingSolution fixture's agent.json. A selective `uip` shim (mock_path_dirs, the ixp mock pattern) serves discovery with a BYO entry alongside the same-named built-in, forcing the `IsByo` disambiguation the skill teaches; every other `uip` command passes through to the real CLI. Mocking discovery is what removes the tenant dependency entirely — no feature flag, no fixture registration, no create-time connection probe. - coded byog_middleware / byog_decorator: `UiPathByoGuardrailMiddleware` and `ByoValidator` on the SimpleCodedAgent fixture, mirroring the existing pii_middleware / user_prompt_attacks_decorator pair. Both assert the adapter import — the failure BYO is most exposed to, because `ByoValidator` genuinely lives in `uipath.platform.guardrails`, making a wrong-but-plausible import easy to land. Both carry `disallowed_tools: ["Task"]` for that reason. All three tagged `lifecycle:edit`: they edit an existing agent rather than scaffolding one. Verification - AST checkers validated against 14 controls — 4 positive (inline and variable middleware spread; positional and keyword validator name) and 10 negative (built-in substituted for BYO, wrong name, wrong action, non-factory decoration target, wrong import module, unparseable source). Every negative fails at the intended assertion. - Two-model runs green: byog_middleware 1.000 on claude-sonnet-5 (181s) and gpt-5.6-terra (196s); byog_decorator 1.000 on both (362s / 150s); byog_pinning 1.000 on both (86s / 132s). Generated artifacts inspected in each run rather than trusting the score. - `check-cli-verbs.py` and `check-task-driver.py` clean. Depends on two upstream docs fixes, both merged: UiPath/uipath-python#1854 adds the missing `ByoValidator` section to the core guardrails page (its absence is what made BYO look LangChain-only), and UiPath/uipath-langchain-python#1033 drops a stale docstring line telling readers to pass a connection id that the constructor no longer accepts. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a
### Bring Your Own Guardrail (BYOG)section topackages/uipath/docs/core/guardrails.md, and listsByoValidatorin the execution-stages table underPRE_AND_POST.Why
ByoValidatorships inuipath.platform.guardrails(exported at the top level, like every other validator), but the core guardrails page never got a section for it — the only rendered BYOG documentation is on the LangChain adapter page.That omission actively misleads: reading only the core page, BYOG looks LangChain-only. It isn't —
ByoValidatoris framework-agnostic anduipath_langchain.guardrails.decoratorsmerely re-exports it. I hit exactly this while writing agent-skill documentation and had to read the source to discover the class existed in core at all.What's in it
Same shape as the sibling validator sections: what it does, the all-stages note, the admin prerequisite, a runnable example, and the two parameters.
Verification
Every claim checked against the source, not just copied from the docstring:
uipath.platform.guardrailsresolvesBlockAction,ByoValidator,guardrailvalidator_nameis positional;parametersis keyword-onlyvalidator_type == "byo"; serializes tobyoValidatorNamevia the field aliasByoValidator(" ")raisesValueErrorGuardrail test suite green (129 passed,
-k "byo or guardrail"). Docs only — no code change.