AI Safety / Compliance Pro & Enterprise

An instruction is a request. A guardrail checks what actually got said.

Every AI chatbot vendor tells you their bot is instructed not to give medical advice, or legal advice, or personalized financial guidance. Instructed is not the same as checked. Velaro's Output Guardrails read the response your bot actually generated, before a visitor ever sees it, and hold it against the topics you've decided are off-limits.

Book a demo See the full compliance suite
RESPONSE CHECK
Response generated
Bot drafts an answer to the visitor's question.
Fast scan against restricted categories
Runs on every response. No perceptible delay.
Flagged: possible medical advice
Escalates to an independent confirmation check.
Blocked. Fallback delivered instead.
"Please check with a licensed clinician. Happy to help with something else."
2 layers
Instruction layer plus an independent output check
Every response
Checked before it reaches the visitor, not sampled
Fails closed
Unverified content is blocked, not gambled on
Admin-defined
You set the restricted categories, not Velaro
The Gap

The companies that get burned by AI chat aren't the ones with the worst bots

They're the ones who assumed a well-written system prompt was a guarantee. A system prompt is a set of instructions the model weighs against everything else happening in the conversation, including a visitor who is actively trying to talk it out of those instructions. The instruction can lose that negotiation. Nobody finds out until the transcript does.

Prompt-only guardrail

Hope the model complies

The bot is told what not to say. Whether it actually holds that line depends on how the conversation unfolds: how it was framed, how many turns it ran, whether the visitor rephrased the question until something got through. The check exists at the moment the prompt was written, not at the moment the response was sent.

Output-side guardrail

Verify what was actually written

The response exists as text before it's delivered. That text gets checked against the categories you've defined, independently of what prompt or conversation path produced it. It doesn't matter how the model got there. What matters is whether the words it produced cross a line you set, and that gets confirmed before the visitor sees a single one of them.

How It Works

A checkpoint, not a hope

Built to run on every response without slowing down the conversation most visitors are having, and to escalate only when something is actually worth a second look.

1

Bot generates a response

The AI answers the visitor's question the same way it always has.

2

Fast scan, every time

A lightweight check reads the response against your restricted categories. It runs on 100% of responses and costs almost nothing, so it never gets skipped or sampled.

3

Independent confirmation, only when needed

If the fast scan flags something, a separate check confirms whether it's a real violation or a false positive, like a product spec that happens to share vocabulary with the restricted topic.

4

Send, or block and redirect

Confirmed clean, the response goes out. Confirmed a violation, or if confirmation itself fails, the response is withheld and a fallback message you wrote is sent instead.

Where It Matters Most

Regulated conversations don't stop being regulated because a bot is answering

Any account can define restricted categories. These are the industries where a single unverified answer carries real consequences, and where "the bot was instructed not to" isn't a defense anyone wants to test.

Healthcare-adjacent & medical device rental

Example restricted category
"Never give medical advice, dosing guidance, or a diagnosis. Defer to a licensed clinician."

A visitor asking whether a rented oxygen concentrator is right for their oxygen level is one rephrase away from a question the bot should never answer directly, no matter how it was worded.

Legal services

Example restricted category
"Never give specific legal advice or predict case outcomes. Defer to counsel."

General information about how a process works is fine. The moment a response starts telling a specific visitor what to do about their specific situation, it's crossed from information into advice.

Financial advisory & insurance

Example restricted category
"Never give personalized investment advice or recommend a specific product for a visitor's situation. Defer to a licensed advisor."

Explaining how a product category works is different from telling a visitor what to buy given their goals. The line is easy to describe and easy for a model to blur under pressure.

Questions

What buyers ask before they turn this on

Can this be jailbroken the way a system prompt can?
A jailbreak works by talking the model into ignoring its instructions. Output Guardrails doesn't rely on the model following an instruction at all. It reads the response the model actually produced, after generation, on its own terms. It doesn't matter whether the visitor got there through roleplay, a translation trick, or a long conversation that wore the system prompt down. If the words match a restricted category, the check fires.
Does this slow down every response?
No. The fast scan runs on every response and adds no perceptible delay. The slower independent confirmation only runs on the small fraction the fast scan flags. Most conversations never touch it.
Can we define our own restricted topics, or is this limited to one use case?
Restricted categories are admin-defined per account. You name the category, describe what a violation looks like in plain language, and set the fallback message. Financial services can gate personalized investment advice, legal services can gate specific legal advice, healthcare-adjacent accounts can gate medical advice. Same mechanism, your definitions.
What happens when a response gets blocked?
The visitor never sees the flagged response. They get the fallback message you configured instead, typically a redirect to a licensed professional or a live agent. The conversation continues, and nothing about the block reads as an error or a broken bot.
Does this cost extra?
It's included with Compliance Pro and Compliance Enterprise, alongside PII redaction and the rest of the compliance suite. No separate line item, no per-check billing.
How is this different from just writing a good system prompt?
A system prompt is an instruction the model weighs against everything else in the conversation, and a long or clever enough conversation can outweigh it. Output Guardrails is a second, independent step that runs after generation and checks what was actually written, not what the model was told to write.
What if the confirmation check itself fails or times out?
The response is blocked. Once the fast scan has flagged something as worth checking, any failure in the confirmation step is treated as a reason to withhold the response and send the fallback message, rather than let unverified content through because a check errored out.
Does this replace the compliance instructions already in the system prompt?
No, it runs in addition to them. The system prompt still shapes how the bot behaves in the first place. Output Guardrails checks the result, so a gap in the first layer doesn't become a gap in what the visitor actually receives.

See a blocked response happen live

We'll set up a restricted category on the call and show you the same response getting checked, flagged, and replaced in real time.

Book a demo Full compliance suite