> ## Documentation Index
> Fetch the complete documentation index at: https://docs.box.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Advanced Guardrails

Guardrails let you define the operational boundaries in which an agent or
workflow can act with your Box content. When you configure guardrails, you
decide where an action can run, which managed users it can affect, and how
it interacts with external users. This gives admins precise control over
automated activity and helps keep sensitive content protected while scaling
AI and workflow adoption.

Guardrails are available to Enterprise Advanced customers. Not all actions
referenced in this article are available in every Box product. For
product-specific setup and supported actions, see:

* [Creating workflows in Box Automate](https://docs.box.com/en/box-automate/creating-workflows-in-box-automate.md#advanced-guardrails)
* [Guardrails in custom agents](https://docs.box.com/en/box-ai/creating-and-configuring-agents.md#guardrails)
* [Guardrails for Box MCP server tools](https://docs.box.com/en/box-mcp/admin-controls.md#security-guardrails-for-write-tools)

This article explains the constraint types you can configure, how each
option behaves, and the patterns to follow when defining allowlists and
denylists.

## Guardrail constraint types

You can configure three types of guardrail constraints:

* **Content Restrictions** — controls where the action can run.
* **Managed User Criteria** — controls which internal (managed) users the
  action can involve.
* **External User Criteria** — controls how the action interacts with
  external users.

## Content restrictions

Content restrictions define the target location of the action. From the
**Content Restrictions** dropdown, select one of the following:

* **No restrictions** — no guardrails are applied to the target location.
* **Allow on specific items** — define an allowlist of permitted targets.
* **Don't allow on specific items** — define a denylist of blocked targets.

### Allow on specific items (allowlist)

**Classification Labels:** select one or more classification labels to
define the allowed target. To define criteria based on a classification
label, you must first have Box Shield classification labels configured in your
organization.
See [Classification Labels](https://docs.box.com/en/box-shield/shield-classification-labels-and-policies/classification-labels.md).

*Examples of using classification-based content restrictions:*

* For **Delete File**, selecting **Internal Only** means only files
  labeled Internal Only can be deleted.
* For **Move File**, selecting **Internal Only** means files can only be
  moved into folders labeled Internal Only.

**Folders:** select one or more folders to define the allowed target. What
that selection covers depends on whether the action targets a folder or a
file.

* When the action targets a folder, the selection covers that folder and
  its subfolders. For example, with Folder A selected, a create file action
  can create a file in Folder A and in a subfolder of Folder A.
* When the action targets a file, the selection covers files saved directly
  in that folder. For example, with Folder A selected, an edit file action
  can edit a file saved directly in Folder A. A file saved in a subfolder of
  Folder A is outside that selection.

**Hubs:** select one or more Hubs to define the allowed target.

### Don't allow on specific items (denylist)

**Classification Labels:** select one or more classification labels to
define the blocked target. To define criteria based on a classification
label, you must first have Box Shield classification labels configured in
your organization.
See [Classification Labels](https://docs.box.com/en/box-shield/shield-classification-labels-and-policies/classification-labels.md).

*Examples of using classification-based content restrictions:*

* For **Delete File**, selecting **Restricted** means files labeled
  Restricted cannot be deleted.
* For **Move File**, selecting **External Sharing** means files cannot be
  moved into folders labeled External Sharing.

**Folders:** select one or more folders to define the blocked target. What
that selection covers depends on whether the action targets a folder or a
file.

* When the action targets a folder, the selection blocks that folder and its
  subfolders. For example, with Folder A selected, a create file action is
  blocked from creating a file in Folder A and from creating a file in a
  subfolder of Folder A.
* When the action targets a file, the selection blocks files saved directly
  in that folder. For example, with Folder A selected, an edit file action is
  blocked from editing a file saved directly in Folder A. A file saved in a
  subfolder of Folder A is still allowed.

**Hubs:** select one or more Hubs to define the blocked target.

#### Don't allow on any externally accessible items

The **Don't allow on any externally accessible items** toggle is available
only when you select **Don't allow on specific items**. Enable it to
prevent the action from running at any target location that is externally
accessible. A location is considered externally accessible when any of the
following are true:

* The target, any folder in its ancestor tree, or a Hub containing it is
  accessible to the public through a shared link.
* The target, any folder in its ancestor tree, or a Hub containing it is
  accessible to external collaborators.
* The target is owned by an external organization or user.

*Example:* with **Don't allow on any externally accessible items** enabled
for **Upload File**, a file cannot be uploaded to a folder (or any ancestor
folder) that has a shared link set to anyone can access, has external
collaborators, or is owned by an external user.

## Managed user criteria

For actions that involve internal users, use **Managed User Criteria** to
define which managed users the action can target. From the dropdown,
select one of the following:

* **No restrictions** — no managed user guardrail is applied.
* **Specific managed users only** — allowlist of permitted managed users.
* **All managed users, with exceptions** — denylist of blocked managed
  users.

After you select an option, enter user names into the **Select users** text
box and select the users you want to include.

Common uses of managed user guardrails:

* **Add Collaborator** — allow only a specific list of managed users to be
  added by a workflow.
* **Send Notification** — limit notifications to an approved list of
  managed users.

## External user criteria

For actions that involve external users, use **External User Criteria** to
define how the action can interact with them. From the dropdown, select
one of the following:

* **No restrictions** — no external user guardrail is applied.
* **Specific external users only** — allowlist of permitted external
  users.
* **All external users, with exceptions** — denylist of blocked external
  users.
* **External users not permitted** — blocks the action from involving any
  external user.

After you select **Specific external users only** or **All external
users, with exceptions**, enter user names into the **Select users** text
box and select the users you want to include.

Common uses of external user guardrails:

* **Add Collaborator** — select **External users not permitted** to
  prevent any external collaborator from being added by the workflow or
  agent.
* **Send Notification** — limit outbound notifications to a defined list
  of external users.

## Known limitations

* Box MCP server guardrails apply only to write tools. To control which
  content agents can read, use [Shield Smart Access policies](https://docs.box.com/en/box-shield/shield-smart-access-policies).
* Not every action supports every constraint type.
* Guardrails configured for Box AI custom agents don't apply to session
  folders. If guardrails block the agent from saving a file to another
  folder, the Box AI custom agent saves the file in the session folder
  instead.
* Classification-based guardrails depend on the classification labels
  defined for your enterprise.
  See [Classification Labels](https://docs.box.com/en/box-shield/shield-classification-labels-and-policies/classification-labels.md).