# Block Unsafe Employee Responses

Output Safety reads your employee's reply before anyone else does. Toxic, abusive, or otherwise unfit answers are held back rather than sent, which is what you want the moment employees write to customers, post to a channel, or answer a ticket without you watching. It checks the reply your employee actually wrote, so what you see caught is what would genuinely have gone out. Set it to Low, Medium, or High and review everything it held back in the live inspector. Blunt, direct, and critical business writing is left alone: the policy is looking for replies that would embarrass you, not ones that are simply frank.

Output Safety reviews every response your AI employee generates before it is delivered, on every channel from chat to email to Slack. Toxic content, unsafe instructions, and replies that drift from your brand's tone are caught and blocked, so nothing an employee produces reaches a customer, teammate, or channel without passing the check first.

The check runs on a separate, lightweight model built for a fast yes-or-no call, not the model that wrote the reply. It gets a 5-second window with one retry on a timeout, and its own token usage is metered and billed to your account like any other model call, on top of the credits the employee spends generating the response itself.

A blocked response is never rewritten or regenerated: the recipient sees a short policy message in its place, and the block is logged as a violation you can review. If the check itself cannot complete after two tries, it fails open rather than holding up the reply, the original response goes out unfiltered, and the outage is flagged internally so it gets fixed rather than silently tolerated. Output Safety also shares its scanning pass with Data Leakage Prevention: enable both and one check covers both, with Output Safety's sensitivity setting taking precedence.

Blunt is not the same thing as unsafe, and the policy is written to know the difference. A firm no, a one-line answer, a critical read of someone's draft: all of that passes untouched. What gets stopped is abuse, slurs, threats, instructions that could hurt someone, and replies so far from your voice that a reader would notice. An employee that hedges every sentence is less useful than one that speaks plainly, so the gate is deliberately not tuned to soften people.

The check runs exactly once per reply and it is the last thing that happens before delivery. That ordering is the whole point. It reads the words your employee actually wrote, in their final form, not a draft and not a summary of one. So what you see held back in the log is what would genuinely have reached the customer, which is what makes the log worth reading.

What you get back is permission to leave employees talking to people while you are somewhere else. Overnight support, weekend inbox coverage, outreach that runs during a meeting: all of it leaves through the same checkpoint, and message four thousand is read as carefully as message one. Coverage does not thin out when volume spikes, which is exactly the moment a manual spot check would start missing things.

## Every Response Checked Before It Ships

Language models are probabilistic, and at sufficient volume, rare failures happen. Output Safety accepts that premise and adds a checkpoint after generation: each response is evaluated before delivery, and anything unsafe, toxic, or off-tone is stopped there.

The customer, the inbox, or the Slack channel only ever sees what passes. The failure that would have been a screenshot on social media becomes a logged event in your dashboard instead.

## On-Brand Is Part of Safe

Safety here is not only about toxicity. A reply that is technically harmless but sarcastic, dismissive, or wildly off your voice damages trust in quieter ways. The output layer evaluates tone as well as content, keeping employees inside the personality you gave them.

This matters more as your workforce grows. Ten employees across five channels is a volume of communication no human reviews line by line. The output gate reviews all of it, every time, at machine speed.

## What Happens When a Response Is Blocked

A blocked response is not delivered as generated. The recipient sees a short policy message instead, the block is logged with the category and reason, and you can watch patterns across employees to tell whether something upstream, like a prompt, a skill, or a policy, needs attention.

Sensitivity is one company-wide setting per tenant, Low, Medium, or High, defaulting to Medium, and it applies to every employee on every channel the same way. There is no per-employee dial: loosen or tighten it from the Policies tab and the change takes effect immediately across the whole workforce.

## How It Works

**Generated responses pass a safety and tone checkpoint before they reach anyone.**

After the employee drafts a response and before it is delivered, the output layer evaluates it for toxicity, unsafe instructions, and drift from your brand voice. Clean responses, which is nearly all of them, go straight out with no perceptible delay.

Anything that fails is blocked rather than rewritten. The recipient sees a short policy message in place of the reply, and the block is recorded with its category and reason so you can open it later and see exactly what was stopped. Strictness is one company-wide setting, Low, Medium, or High, so every employee on every channel is held to the same line and you move that line in a single place.

If the check itself cannot finish, it fails open. After a short timeout and one retry the original reply is delivered unchecked rather than left sitting there, and the failure is flagged internally so it gets fixed instead of quietly tolerated. That is a deliberate trade: a customer waiting on an answer is a real cost, and the gate is not allowed to become the reason your workforce goes silent.

## Use Cases

### Public support agent never embarrasses the brand

Off-tone or unsafe replies are caught before a customer ever sees them.

### Scaled outreach stays on voice

Across thousands of messages, every one is checked against your tone, not just the first few.

### Regulated industries keep responses in bounds

Unsafe claims are filtered before delivery, supporting compliance review.

### Teams catch upstream problems early

A spike in blocks points to a prompt or policy that needs a fix before it spreads.

## Comparison

| Before | After |
|---|---|
| A bad AI reply becomes a public screenshot. | It becomes a blocked, logged event instead. |
| Tone drifts as you scale message volume. | Every message is checked against your voice. |
| Reviewing output by hand is impossible at scale. | The gate reviews all of it, every time. |
| You learn about failures from angry customers. | You see them in the dashboard before they ship. |

## FAQ

### Can AI responses be filtered before customers see them?

Yes. Output Safety evaluates every response before delivery on every channel, blocking toxic, unsafe, or off-tone content automatically.

### Does output safety rewrite or regenerate the response?

No. It is a pass or block checkpoint, not an editor. A response that passes goes out untouched; a response that fails is replaced with a short policy message, and the original is never sent.

### Can I see what was blocked and why?

Yes. Blocked outputs are logged with the category and reason, giving you visibility into how often the gate fires and whether anything upstream needs adjusting.

### What happens if the safety check itself fails or times out?

It fails open. After a five-second timeout and one retry, an unchecked response is still delivered rather than held back, and the outage is flagged internally for us to fix. It is not silently swallowed.

### Does running Output Safety cost extra credits?

The check itself runs on a separate model and that usage is metered and billed like any other model call, in addition to the credits the employee spends generating the reply.

### Will output safety block blunt or critical business writing?

No. Output Safety is tuned for abuse, unsafe instructions, and replies that would embarrass you, not for directness. A firm no, a one-line answer, or a critical read of someone's draft passes straight through, because an employee that hedges every sentence is worse at the job than one that speaks plainly.

### Where do I switch output safety on or change how strict it is?

Output Safety lives on the Policies tab of your company dashboard in Sistava. It is a single organization-wide switch with a sensitivity of Low, Medium, or High, defaulting to Medium, and the change applies to every employee on every channel as soon as you save it.

### Do I still need output safety if data leakage prevention is already on?

They catch different problems. Data Leakage Prevention looks for your own confidential material leaving in a reply, while Output Safety judges whether the reply itself is safe and on tone. Turn both on and they share one scanning pass, so the work is not done twice.

## Where Block Unsafe Employee Responses fits

Block Unsafe Employee Responses is part of What stops them from going wrong.

Your AI agents pause before any sensitive action and wait for your approval. PII is detected and redacted before it reaches the model. Content policies block harmful or off-brand output. Execution limits prevent runaway tasks. A Sistava mentor pairs with every employee to spot blockers and keep work on track alongside their team leader. Set company-wide policies once and every employee follows them, including future hires.

- [What stops them from going wrong](/en/features/guardrails): Nothing sensitive happens without your say.

## Read the guide

- [Guide: Block Unsafe Employee Responses](/en/guide/company/policies)

## More in Guardrails

- [AI Guardrails & Policies](/en/features/guardrails/guardrails): A Security Officer that checks every message going into and coming out of every AI employee you have. Five policies, each with its own switch: Input Safety stops prompt injection and jailbreak attempts, Output Safety keeps unfit replies from being sent, PII Protection replaces personal data with markers before the model reads it, Data Leakage Prevention keeps your setup and secrets in-house, and Topic Control holds employees to the subjects you choose. Turn on what you need from Settings, Technical, Security Officer and it covers every employee on the next message, including the ones you hire later. Checks run in parallel on a separate lightweight model, so protection costs a fraction of a message and your team never feels the wait. A running count of what has been caught, the busiest policy, and a live inspector showing every individual message are all on the same page.
- [Protect Against Prompt Injection](/en/features/guardrails/guardrail_input_safety): Input Safety reads every incoming message before your employee does, and stops the ones trying to hijack it: instructions to ignore its rules, requests to print its own configuration, and role-play framed to talk it out of its guardrails. That matters most where the message did not come from you, so a payload buried in a forwarded email, a support ticket, or a shared thread cannot turn your employee against you. Pick Low, Medium, or High, and every level catches the textbook attacks: the level decides how much benefit of the doubt the genuinely ambiguous messages get. Medium is the default and suits most companies. Blocked messages get a short, human reply and the conversation carries on, with each one recorded so you can see what has been tried.
- [Protect Personal Data](/en/features/guardrails/guardrail_pii_protection): PII Protection finds personal data in a message and replaces it with a marker before the model reads a single character of it. A pasted card number becomes [CREDIT_CARD], an email becomes [EMAIL_ADDRESS], and the same happens on the way out so nothing sensitive travels back into an email, a channel, or a ticket. You pick exactly what to protect from seven data types: email, phone, name, credit card, Social Security number, IP address, and address. The markers keep the sentence readable, so your employee understands the request perfectly and keeps working while the raw value stays out of the conversation. It runs on every message, in both directions, company-wide, from one switch.
- [Control What Employees Discuss](/en/features/guardrails/guardrail_topic_control): Topic Control gives you two lists and you can use either or both. Blocked topics are off-limits no matter how a conversation gets there, which keeps employees out of politics, competitor comparisons, or medical and legal advice. Allowed topics set a remit instead: name the subjects an employee handles and anything unrelated is politely declined, which is how you keep a support employee on product help, billing, and refunds. Both lists match on meaning rather than exact words, so ruling out competitor pricing also covers how much cheaper are we than the other tools out there. Greetings and short replies always get through, so a scoped employee still feels natural to talk to.
- [Keep Confidential Data In-House](/en/features/guardrails/guardrail_data_leakage): Data Leakage Prevention guards both ends of the conversation. On the way in it recognises someone fishing for your employee's internals, whether they ask outright, dress it up as a game, or try the repeat everything above this line trick. On the way out it reads the reply itself and holds it back if it is about to hand over a system prompt, internal configuration, an access token, or a credential. Questions about your own business data are never affected, so an employee still answers freely about your customers, documents, and numbers. One switch, no configuration to maintain, and every attempt is logged so you can see who has been probing.
- [Prevent Repeated and Runaway Actions](/en/features/guardrails/tool_safety): Sistava automatically caps how many emails, messages, and external writes (CRM records, calendar events, paid searches) an AI employee can send in a single conversation, hour, and day, and blocks an identical send to the same recipient from going out twice within 24 hours. These limits run in the background per employee with no setup required, so a stuck task or unexpected loop cannot spam a contact's inbox, pollute your CRM, or burn through paid API calls. When a limit is hit, the employee is told to slow down or hand the task to a human instead of retrying blindly.
- [Approve Sensitive Actions](/en/features/guardrails/input_requests): Let an AI employee pause and ask before it takes a sensitive action, like sending an email or spending on a paid tool, instead of guessing what you want. An inline card shows up right in the chat with Approve, Reject, or option buttons, and the employee resumes the instant you respond.
- [Protect Organisation Information](/en/features/guardrails/information_boundaries): Your AI employee treats what it learns in the workspace the way a careful coworker would: useful for doing the work, not free to repeat. It tells private, role-restricted, and confidential information apart from ordinary shared context, and it never volunteers the sensitive kind just because someone asked. When a teammate needs a restricted answer, the employee can request permission from the right person for that one specific answer instead of guessing or refusing outright.
- [Protect Your Email Reputation](/en/features/guardrails/email_deliverability): Every email your AI employees send, whether it is a notification, a mailbox reply, or an outbound message, passes through a pre-send check before it leaves. Sistava validates the address, checks it against a suppression list built from past bounces and complaints, and blocks anything that would hurt your sending reputation. You do not configure this: it runs silently on every send so your domain keeps a clean track record with inbox providers.
- [Delegation & Teamwork Limits](/en/features/guardrails/delegation_teamwork_limits): Tune how your leader employees hand off work to teammates. Set how many teammates a leader can delegate to at once, how far a delegation chain can reach, how long a delegated teammate can work before timing out, and how tolerant employees are of repeating themselves before loop protection stops them.
- [Detect and Redact PII](/en/features/guardrails/pii_detection): PII Protection watches every message your AI employees send and receive, and masks personal data like emails, phone numbers, credit card numbers, and social security numbers before it goes anywhere it shouldn't. You choose exactly which data types to catch. It runs on every employee across your company the moment you turn it on, with no per-employee setup.
- [Company-Wide Policies](/en/features/guardrails/company_policies): Company Policies let you set organization-wide safety rules that apply to every AI employee at once: block prompt injection attempts, filter harmful output, redact personal information, stop internal details from leaking, and restrict which topics employees can discuss. Turn each policy on with one toggle from your company dashboard, and it takes effect immediately across your whole team.

## Explore

- [Every feature](/en/features)
- [Hire an AI employee](/en/market)
- [Pricing](/en/pricing)