Filter prompt attacks and sensitive data by adding AI Guardrails to Zapier workflows

This tool evaluates input text before it reaches an AI model to stop prompt injection, and checks model outputs for personally identifiable information (PII). Because language coverage and false positive rates vary, sensitive workflows should always include a human approval step.

Which detection action should you choose?

AI Guardrails separates its actions into two underlying architectures: machine learning (ML) actions and large language model (LLM) actions. Choose AWS Comprehend-powered ML actions when deterministic, rule-based screening is required, and select Amazon Bedrock-powered LLM actions for contextual reasoning and evasion detection.

Checked: 2026-10-24 KST / Source: Zapier official support documentation

For customer inquiry forms or support ticket triggers where external users supply raw text, place Detect Prompt Attack ahead of any AI model call. Conversely, if your Zap drafts customer replies and automatically sends emails, place Check for Personally Identifiable Information (PII) or Detect Toxicity after the model step to prevent external leaks.

In what order should you arrange the workflow?

The execution sequence follows Trigger Input → Primary Screening → Conditional Branching → Model Execution → Secondary Screening → Safe Action.

1. Trigger Input: Receive external text through a web form, incoming email, or support ticket.
2. Primary Guardrail Check: Add AI Guardrails by Zapier and map the incoming text to the Text to Check field. Choose Detect Prompt Attack to catch jailbreaks or instructions meant to manipulate the system.
3. Conditional Branching (Filters or Paths): Route the execution flow based on structured check outputs. Proceed if no threat is detected; halt execution or send an administrator alert if a violation is flagged.
4. AI Model Execution: Pass only verified, clean text to downstream AI steps such as OpenAI or Anthropic to generate text or summarize information.
5. Secondary Guardrail Check: Run Check for Personally Identifiable Information (PII) on the generated output to verify that no sensitive data is exposed.
6. Final Delivery and Approval: Store or transmit clean responses directly, or trigger a Zapier Human in the Loop step for manual review when flagged items are detected.

As with previous guidance on Zapier agent migration steps and Muse permission scopes, isolating untrusted inputs from LLM processing steps remains a fundamental operational requirement.

How do you handle detection results?

Guardrail actions return structured outputs and confidence scores rather than simple success or failure responses. You can use these values in downstream Zapier Filters or Paths to control execution flow.

• Pass/Fail Flags: Return boolean indicators showing whether a prompt attack or PII was detected. Setting a filter condition such as Passed exactly matches true ensures the workflow only advances when inputs are clean.
• Detected Entity Lists: PII checks return a list of specific entity types (such as EMAIL, NAME, or SSN). This structured list can be formatted into an alert sent to an internal security channel.
• Confidence Scores: Numerical values indicating the model's certainty level. Setting threshold values too high risks missing subtle attacks, while setting them too low increases false positives on legitimate requests. Using conservative thresholds during initial rollout helps identify baseline rates.

When risk is detected, routing the data to a Human in the Loop step for manual review is safer than simply terminating the task with an unhandled failure.

How are data retention and security handled?

AI Guardrails analyzes text in real time and uses encrypted connections when transmitting data to AWS Comprehend and Amazon Bedrock.

According to official documentation, Zapier's AWS organization setup opts out of allowing underlying AI services to use customer data for model training. This ensures that text processed through guardrails is not retained for vendor model improvement.

However, like all Zapier workflows, processed data remains temporarily stored in Zapier execution logs for 7 days, and in Zap Runs for 29 to 69 days depending on your subscription plan. Enterprise plans can reduce history retention to 7 days. Workflows handling sensitive data require regular log retention maintenance.

What should you verify before going to production?

Official documentation stresses that AI Guardrails is not a standalone security solution, but one layer in a defense-in-depth architecture. Verify three operational boundaries before enabling production workflows:

• Language Coverage: The PII detection action currently officially supports English and Spanish. Non-supported languages like Korean may miss local identification numbers, requiring supplementary regex Formatter steps or internal validation scripts.
• False Negatives and False Positives: No AI-based detection system is completely accurate. Novel adversarial prompt techniques or slang can bypass filters, while standard business inquiries may occasionally be misclassified as toxic.
• Testing Scenarios: Before publishing a live workflow, run test batches containing both valid business requests and deliberate prompt injection attempts. Confirm that filter steps halt compromised runs and escalate them to human review.

Build an internal test Zap with 5 legitimate requests and 5 adversarial test prompts, and verify that Filters and Paths route each case as expected.