Skip to content
Decisio

DocsUse cases

2 min read · updated

Guardrails

Check each message against a policy, such as toxicity, in one yes-or-no question; block or allow what decisio can stand behind, and send the rest to a moderator.

This script asks one yes-or-no question and blocks or allows only on a certified answer:

import json
import urllib.request


QUESTION = {
    "type": "noul",
    "instructions": "Is this message toxic: insulting, hateful, threatening or sexually explicit?"
}




def route(text):
    request = urllib.request.Request(
        "http://127.0.0.1:8000/v1/systemone",
        data=json.dumps({"state": text, "questions": {"toxic": QUESTION}}).encode(),
        headers={"Content-Type": "application/json"},
    )
    with urllib.request.urlopen(request) as response:
        answer = json.load(response)["answers"]["toxic"]
    # A certified answer acts on its own; anything else goes to a person.
    if answer.get("certified"):
        return "block" if answer["noul"] >= 0.5 else "allow"
    return "to a moderator"




print(route("Thanks, that fixed it!"))

Run against the CPU stand-in at v0.18.1 on 2026-10-19. It printed:

to a moderator

Until the task is certified (step 2), every answer goes to a person, as on the stand-in.

Good fit

  • A policy you can state as a yes-or-no question: is it toxic, is it off-topic, does it ask for a refund.
  • Labelled messages, to certify from.

Not a good fit

  • A policy that needs the whole conversation when you send one message.
  • A single gate in front of something dangerous: keep a person or a second check on what is not certified.

1. Write the question

Section titled “1. Write the question”

One noul question, which answers with the probability of yes. Several policies are several questions in the same request, read once.

2. Teach it and certify it

Section titled “2. Teach it and certify it”

A clear yes-or-no question the model already answers well often needs no teaching: the server declines a correction that does not help, and says so. Certify it anyway, so each answer says whether it can act on its own.

Send at least 118 labelled messages. The server holds back half to certify, and a 5% certificate needs 59 of those. More examples certify a larger share.

POST /v1/tasks
{"id": "guardrails",
 "examples": [{"request": {"state": "<a past item of yours>", "questions": {"toxic": <the question above>}},
               "answer": false},
              ...],
 "certify": {"alpha": 0.05}}

A shape to fill in, not a command to run.

Certify answers runs this call on a server, with its answer.

3. Route on the certificate

Section titled “3. Route on the certificate”
  • A certified yes blocks; a certified no allows.
  • Everything else goes to a moderator.
  • When the messages change, a new kind of abuse, a new language, certification is suspended until you certify again (Watch for drift).

What it did

Section titled “What it did”
  • 97.3% right on ToxicChat's toxicity question, with a calibration error of 0.036, on Gemma 4 31B, untaught, in decisio's 1,400-item suite: one RTX PRO 6000, vLLM 0.30.0, 2026-10-04 (its evaluation card, section 7.2). The model's default settings were tuned on that same suite, so that calibration error is its best case.
  • Other guardrails, such as off-topic or prompt-injection checks, follow the same recipe; no run of them is published.

What next

Section titled “What next”