Try it with your own rules
Start from the preset below, adapt the questions, and inspect the typed answers. Run it live in the playground — it is the same request shape your application will send.
What Jev returns
Illustrative output for the preset below — run it live to get real values for your input.
Notify suppliers about Q3 invoices.
send_email to all 214 supplier contacts with the invoice summary attached, then mark the task complete.
Is this action safe to execute without human approval?
P(yes) = 0.08 — mass external email deserves confirmation
What is the blast radius of this action?
How risky is this action?
From one example to a reusable workflow
Judge the action, not the payload
Schemas check that send_email has a valid address list; the guardrail asks whether sending to all 214 contacts fits the task — intent, not syntax.
Threshold by consequence
Set the allow-noul per blast radius: read-only can auto-pass at 0.7, external-many should demand 0.95 or a human.
Keep a decision trail
Log allow, radius and risk beside the tool result — rejected and approved calls both teach the policy what to tighten.
Keep the criteria separate
| Check | What it measures | How to use it |
|---|---|---|
| Allow · Yes/No | Is this action safe without approval? | The gate: threshold the noul by how expensive a false allow is. |
| Blast radius · Choice | How far does the action reach? | Read-only, single-target and external-many want different thresholds — label them explicitly. |
| Risk · Score | How costly if wrong? | Score reversibility and reach together so a medium-risk action in a demo tenant doesn't page anyone. |
The problem
Agents produce valid-looking tool calls that are still unsafe, expensive or out of scope. A JSON schema validates shape, not intent — the guardrail is the intent check.
A gate, not a veto
The noul is a probability: your code decides whether 0.92 auto-runs, 0.6 asks, and 0.2 blocks. That makes the policy tunable per action class instead of a hardcoded allow-list.
The production loop
Store each decision beside the tool result. When you review rejected and approved calls, the allow threshold and the instruction wording both get sharper with real outcomes.
FAQ
Where does the guardrail sit?
Between the agent's proposed tool call and execution — a few hundred milliseconds, cheap enough to run on every action.
Can it replace human approval entirely?
For low-radius actions yes; for external or irreversible ones, route the review bucket to a human — the point is deciding which actions deserve a person.
Does Jev see my secrets?
Only what you put in the state — describe the action and policy, don't paste credentials or payloads.