What Changes for Enterprise Governance

OutSystems now lets System Administrators define custom, organization-wide guardrail policies for every AI agent built on the platform, going beyond the built-in default categories. Three new controls are available: denied topics described in plain language, word and phrase filters for specific terms, and custom Personally Identifiable Information (PII) patterns defined with regular expressions.

‍

What changed

Until now, OutSystems' AI Guardrails protected agents using a set of predefined categories. As of August 6, 2026, System Administrators can layer three kinds of custom policy on top, applied as a baseline across every agent in the organization:

• Denied topics, described in plain language. Detection evaluates meaning and intent, not just keywords, so paraphrased or implied content is still caught.
• Word and phrase filters for exact terms, such as competitor names, internal codewords or sensitive phrases.
• Custom PII patterns, defined with regular expressions, so organization-specific data formats like employee IDs, account numbers or booking codes are detected and blocked or masked.

Developers can add stricter rules for their own agents, but can never weaken the baseline set by the administrator. Every intervention is logged and traced to the exact rule that triggered it, keeping the system auditable.

‍

Moxie's perspective

Default guardrails are built for the average customer, and regulated companies rarely are average. A bank doesn't just need to block "generic PII": it needs to catch its own account number format, its own internal case-reference codes and the names of products it can't legally discuss in an AI response. That's precisely the gap these organization-wide, regex-based rules close.

For us, this is one more example of governance becoming a platform capability rather than something every project team has to build from scratch. It considerably shortens the conversation with a client's security or compliance team, because the control isn't bespoke code we wrote: it's a documented, auditable feature of the platform itself.

‍

Frequently asked questions

What are OutSystems' new AI agent guardrails? Custom, organization-wide rules for denied topics, word and phrase filters, and custom PII patterns that System Administrators can apply as a baseline across every AI agent on the platform.

Can individual developers override these guardrails? They can add stricter rules for their own agents, but they can never weaken the administrator-defined baseline.

Is every guardrail action logged? Yes. Every intervention is logged and traced back to the exact rule that triggered it, for audit and troubleshooting.

‍

Building AI agents that need to pass a security review? Talk to our team.

‍

Sources - OutSystems Product Updates, "New agent guardrail policies," August 6, 2026

‍