# uip guardrails > Syntax and options for `uip guardrails byo-configurations`, which manages bring-your-own (BYOG) guardrail configurations for UiPath AI Trust Layer. `uip guardrails` manages **bring-your-own guardrail (BYOG)** configurations for UiPath AI Trust Layer — wiring a tenant's own content-safety/validation connector (for example, Azure AI Content Safety) into a named guardrail a coded agent can reference by alias. There is one command group, `byo-configurations`. This corresponds to Admin → AI Trust Layer → Guardrails Configurations in the UI. See [`uip llm-gateway`](./uip-llm-gateway.md) for the LLM model discovery API some guardrail validators (e.g. LLM-as-judge) route through. ## Concepts - **Configuration vs. validator.** A **validator** (`--validator-type`, e.g. `pii_detection`) is a capability a connector exposes — discover them with `list-validators`. A **configuration** wraps one validator with a connection and a tenant-unique alias (`--validator-name`) that a coded agent's `ByoValidator(...)` call references; `ValidatorName`/`ValidatorType` are locked at creation, so change either by deleting and re-creating. - **Probe-before-save.** `create` always probes the connection/validator pair first and aborts if the probe fails — there is no skip flag, because the backend persists whatever connection ID it's given without validating it itself. `update` only re-probes when `--connection-id` changes; changing just `--fallback-on-ui-path` or enabled/disabled state does not re-probe, so a configuration whose vendor is currently down can still be disabled. - **`--fallback-on-ui-path`** (default `false`) — if set, a failed BYO call falls back to UiPath's own built-in guardrail instead of failing the request. - **Feature gating.** If BYOG isn't enabled for the tenant, every verb fails with `Code: "ByoGuardrailsUnavailable"` and points you at UiPath support. ## Synopsis ``` uip guardrails byo-configurations list uip guardrails byo-configurations create --connection-id --validator-name --validator-type [--fallback-on-ui-path] [--disabled] uip guardrails byo-configurations update [--connection-id ] [--fallback-on-ui-path | --no-fallback-on-ui-path] [--enabled | --disabled] uip guardrails byo-configurations delete --force uip guardrails byo-configurations probe --connection-id --validator-type uip guardrails byo-configurations list-validators --connection-id ``` All verbs also accept `--login-validity ` (override the interactive-login token lifetime). ## uip guardrails byo-configurations list List BYOG configurations for the authenticated tenant, including connection/connector details. ### Example ```bash uip guardrails byo-configurations list ``` ### Data shape (--output json) ```json { "Code": "ByoGuardrailConfigurationsList", "Data": [ { "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010", "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df", "ValidatorName": "my-pii-guardrail", "ValidatorType": "pii_detection", "FallbackOnUiPath": true, "Enabled": true, "CreatedAt": "2026-07-01T10:00:00Z", "UpdatedAt": null, "ConnectorKey": "uipath-azure-contentsafety", "ConnectorName": "Azure AI Content Safety", "ConnectionName": "My Content Safety Connection", "ValidConnection": true } ] } ``` `ValidatorName` is the tenant-chosen alias; `ValidatorType` is the raw validator ID. `ValidConnection` reflects whether the underlying Integration Service connection currently resolves. ## uip guardrails byo-configurations create Create a BYOG configuration. Always probes the connection/validator pair first (see [Concepts](#concepts)) — the create is aborted with the probe's own failure if it doesn't pass. ### Arguments None — everything is passed via options. ### Options | Long | Value | Required | Description | |---|---|---|---| | `--connection-id ` | GUID | **yes** | Integration Service connection the guardrail calls through. | | `--validator-name ` | string | **yes** | Tenant-unique alias — what a coded agent passes to `ByoValidator(...)`. | | `--validator-type ` | string | **yes** | Raw validator ID, e.g. `pii_detection`. Discover valid values with `list-validators`. | | `--fallback-on-ui-path` | flag | no | Fall back to the UiPath built-in guardrail if the BYO call fails. Default `false`. | | `--disabled` | flag | no | Save the configuration disabled. Default is enabled. | | `--login-validity ` | integer | no | Override the interactive-login token lifetime. | ### Example ```bash uip guardrails byo-configurations create \ --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df \ --validator-name my-pii-guardrail --validator-type pii_detection ``` ### Data shape (--output json) ```json { "Code": "ByoGuardrailConfigurationCreated", "Data": { "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010", "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df", "ValidatorName": "my-pii-guardrail", "ValidatorType": "pii_detection", "FallbackOnUiPath": false, "Enabled": true, "CreatedAt": "2026-07-01T10:00:00Z", "UpdatedAt": null, "ConnectorKey": null, "ConnectorName": null, "ConnectionName": null, "ValidConnection": null } } ``` The connector/connection detail fields (`ConnectorKey`, `ConnectorName`, `ConnectionName`, `ValidConnection`) are `null` on create — they're populated on `list`, which joins against the connection at read time. ## uip guardrails byo-configurations update Update the connection, fallback behavior, or enabled state of an existing configuration. `ValidatorName`/`ValidatorType` cannot be changed — delete and re-create instead. ### Arguments | Name | Required | Purpose | |---|---|---| | `` | yes | BYOG configuration GUID, from `list`. | ### Options | Long | Value | Description | |---|---|---| | `--connection-id ` | GUID | New connection. Re-probes the pair before saving — aborts on probe failure. | | `--fallback-on-ui-path` / `--no-fallback-on-ui-path` | flag | Set or clear the fallback flag. | | `--enabled` / `--disabled` | flag | Mutually exclusive — enable or disable the configuration. | | `--login-validity ` | integer | Override the interactive-login token lifetime. | At least one of `--connection-id`, `--fallback-on-ui-path`/`--no-fallback-on-ui-path`, or `--enabled`/`--disabled` is required — omitting all of them fails client-side before any lookup. ### Example ```bash uip guardrails byo-configurations update e5723bb8-fbc2-4317-c7d7-08de803bc010 \ --connection-id 24887687-1234-4abc-9def-012345678901 ``` ### Data shape (--output json) Same shape as `create`'s response, with `UpdatedAt` now set. ## uip guardrails byo-configurations delete Permanently delete a BYOG configuration. ### Arguments | Name | Required | Purpose | |---|---|---| | `` | yes | BYOG configuration GUID, from `list`. | ### Options | Long | Value | Required | Description | |---|---|---|---| | `--force` | flag | **yes** | Skip the confirmation guard. Omitting it fails with an explicit "Refusing to delete without --force" error — deletion is otherwise permanent. | | `--login-validity ` | integer | no | Override the interactive-login token lifetime. | ### Example ```bash uip guardrails byo-configurations delete e5723bb8-fbc2-4317-c7d7-08de803bc010 --force ``` ### Data shape (--output json) ```json { "Code": "ByoGuardrailConfigurationDeleted", "Data": { "Id": "e5723bb8-fbc2-4317-c7d7-08de803bc010" } } ``` ## uip guardrails byo-configurations probe Test whether a connection can serve a validator, without creating or saving anything. The backend asks the connector for its validators, then evaluates a benign test input using the validator's default parameters. ### Options | Long | Value | Required | Description | |---|---|---|---| | `--connection-id ` | GUID | **yes** | Integration Service connection to test. | | `--validator-type ` | string | **yes** | Validator ID to test. Discover values with `list-validators`. | | `--login-validity ` | integer | no | Override the interactive-login token lifetime. | ### Example ```bash uip guardrails byo-configurations probe \ --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df --validator-type pii_detection ``` ### Data shape (--output json) ```json { "Code": "ByoGuardrailProbeSucceeded", "Data": { "ConnectionId": "18fb337c-29b7-4162-a9e8-0c05b01cf4df", "ValidatorType": "pii_detection", "ConnectorKey": "uipath-azure-contentsafety", "IsAvailable": true, "Verdict": "PASSED", "Details": null, "DurationMs": 842, "Error": null } } ``` `IsAvailable` (not `Verdict`) is what gates success/failure — `Verdict` is the vendor's evaluation of the benign test input, so `"PASSED"` and `"FAILED"` both mean the connector answered. The command exits 1 when `IsAvailable` is `false`, with `Code: "ByoGuardrailProbeFailed"` and the same `Data` shape attached to the failure envelope. ## uip guardrails byo-configurations list-validators List the validators an Integration Service connection exposes. Every `Validator` value returned is a valid `--validator-type` for `probe` and `create`. ### Options | Long | Value | Required | Description | |---|---|---|---| | `--connection-id ` | GUID | **yes** | Connection to inspect. | | `--login-validity ` | integer | no | Override the interactive-login token lifetime. | ### Example ```bash uip guardrails byo-configurations list-validators --connection-id 18fb337c-29b7-4162-a9e8-0c05b01cf4df ``` ### Data shape (--output json) ```json { "Code": "ByoGuardrailValidatorsList", "Data": [ { "Validator": "pii_detection", "DisplayName": "PII detection", "Description": null, "Status": "Available", "AllowedScopes": ["Agent", "Llm", "Tool"], "PayloadMinSizeLimit": null, "PayloadMaxSizeLimit": 10000 } ] } ``` ## Error behavior - BYOG not enabled for the tenant: `Code: "ByoGuardrailsUnavailable"`, pointing you at UiPath support. - Unknown configuration ID: `Code: "ByoGuardrailConfigurationNotFound"`, pointing you at `list`. - A probe that runs successfully but finds the pair unusable: `Code: "ByoGuardrailProbeFailed"`, exit 1, with the probe result still attached under `Data` for scripts to inspect. - `delete` without `--force`: fails before any network call. ## See also - [`uip llm-gateway`](./uip-llm-gateway.md) — LLM model discovery, used by LLM-as-judge-style validators. - [`uip is connections`](./uip-is-connections.md) — Integration Service connections referenced by `--connection-id`. - [Tools (plugins)](./concepts-tools.md) - [Global options](./global-options.md) - [Exit codes](./exit-codes.md)